Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29,234 results · page 90 of 585
Jul 3, 2026Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-57987 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-57986 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-57985 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-57984 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-57983 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-57981 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-57975 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-57974 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a networkCVE-2026-56646 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-56645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a netwCVE-2026-45488 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.4
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length.CVE-2026-56015 · Other software · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width. addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) packed address. A prefix length greater than 32 for IPv4 or 128 for IPv6, for example add("1.2.3.4/255", $v) or add("2001:db8::/255", $v), reads past the end of the packed address. The out-of-bounds read happens during trie construction and is bounded: the prefix length is stored as an unsigned char, so the bit walk reads at most 32 bytes from the start of the packed address, a short distance past the end of the 4-byte or 16-byte buffer. It is detectable under AddressSanitizer, valgrind, or a hardened allocator, where it can abort the process. Lookups and dump() format only the valid address width, so the out-of-bounds bytes are not exposed through the module's API.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgrt.cpan.org
Jul 3, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).CVE-2026-47896 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
- Product
- Apache Lucene.Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 3, 2026Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).CVE-2026-47898 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4
Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
- Product
- Apache Lucene.Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 3, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).CVE-2026-47897 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
- Product
- Apache Lucene.Net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 3, 2026When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@exampCVE-2026-8926 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Critical 9.1
When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary codeCVE-2026-8247 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 7.7
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Jul 2, 2026An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a speCVE-2026-13050 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3High 8.6
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
- Product
- Fireware OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Jul 2, 2026Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.CVE-2026-57100 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Entra Provisioning Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.CVE-2026-54998 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Exchange Online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.CVE-2026-45499 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Open AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.CVE-2026-41106 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.3
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft 365 Copilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.CVE-2026-26145 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network servCVE-2026-59101 · Other software · EstrellaXD · reported by VulnCheckMedium 6.9
AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.
- Product
- Auto_Bangumi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG docuCVE-2025-71385 · Other software · netdata · reported by VulnCheckMedium 5.1
Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG document (into a text element) without HTML or XML escaping, and serves the response with Content-Type image/svg+xml. An attacker can craft a URL such as /api/v2/ilove.svg?love=<script>...</script>; when a victim navigates to it the injected script executes in the victim browser in the origin of the Netdata instance (reflected cross-site scripting). These endpoints are registered with HTTP_ACL_NOCHECK and anonymous access and, because bearer-token protection is disabled by default, are reachable without authentication on a default Netdata agent. The issue was resolved by removing the ilove endpoint.
- Product
- netdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackersCVE-2022-50973 · Other software · Yonyou Network Technology Co., Ltd. · reported by VulnCheckCritical 9.3
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a malicious filename and root filepath, with the uploaded file stored under the pictures directory and directly executed by the web server, resulting in unauthenticated remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC).
- Product
- KSOA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network ApplicatCVE-2026-56842 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been removed.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application toCVE-2026-56841 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.8
A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalaCVE-2026-55119 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.1
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application.
- Product
- UniFi Talk Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi NCVE-2026-55118 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.3
A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device.CVE-2026-55117 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.6
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain deCVE-2026-55116 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
- Product
- Dream Machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privCVE-2026-55115 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.9
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escCVE-2026-55114 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.8
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a DeniaCVE-2026-55113 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.
- Product
- UniFi Talk Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniCVE-2026-55112 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.
- Product
- Dream Machines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFiCVE-2026-55111 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.
- Product
- UniFi Protect Floodlight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect ApplicatCVE-2026-54409 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication CVE-2026-54408 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.6
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication CVE-2026-54407 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.6
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints.
- Product
- UniFi Protect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances of UniFi Network ApCVE-2026-54406 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.7
A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances of UniFi Network Application to escalate write permission on the host device.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of CVE-2026-54405 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.
- Product
- UniFi Network Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalCVE-2026-54404 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.8
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of CVE-2026-54403 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 8.6
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command CVE-2026-54402 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS dCVE-2026-54401 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.7
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
- Product
- UniFi OS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escCVE-2026-54400 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to exCVE-2026-50748 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.
- Product
- UniFi Access Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk ApplicCVE-2026-50747 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 9.9
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.
- Product
- UniFi Talk Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2026A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command InjeCVE-2026-50746 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comCritical 10
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device.
- Product
- UniFi Connect Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.