CVE-2026-77539

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...

CVE-2026-77534

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-77537

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device...

CVE-2026-77538

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application...

CVE-2026-77540

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device...

CVE-2026-77545

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-77545

CVE-2026-77545 is a CRITICAL (CVSS 9.0) vulnerability in certain devices running UniFi OS , rated by Ubiquiti (the CNA). An attacker with network access , low privileges , and user interaction can exploit active debug code left enabled on the device to escalate privileges within the affected UniF...

CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-80348

TarsWeb through 3.0.16 has a missing authorization flaw in app/controller/patch/PatchController.js. Four methods—uploadAndPublish , downloadPackage , deletePatchPackage , and setPatchPackageDefault —fail to call the AuthService used for per-application role enforcement. As a result, any authentic...

CVE-2026-80348 TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-80348 TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

EUVD-2026-66387

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-77543

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device...

CVE-2026-77543

An Improper Input Validation vulnerability in the UniFi Access Application (Ubiquiti) allows a network-adjacent actor with low privileges to achieve command injection on the host device, rated CVSS 9.9 (Critical) with changed scope. The attack requires no user interaction and has low complexity. ...

WordPress InfusedWoo Pro plugin <= 5.1.17 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin InfusedWoo Pro versions = 5.1.17...

CVE-2026-77541

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...

CVE-2026-77541

UniFi Network Application (Ubiquiti) is affected by an Improper Access Control vulnerability that allows an attacker with network access and high privileges to escalate privileges within the application. The flaw carries a CVSS 3.1 score of 9.1 (Critical) , with a network attack vector, low compl...

CVE-2026-77540

CVE-2026-77540 is a CRITICAL (CVSS 9.1) vulnerability in UniFi OS Server by Ubiquiti, caused by Improper Input Validation that allows a privileged network attacker to achieve Command Injection on the host device. The attack requires high privileges and no user interaction, with changed scope impa...

CVE-2026-77538

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application...

CVE-2026-77538

An Improper Access Control vulnerability in the UniFi Connect Application (Ubiquiti) allows a network-based attacker with no prior privileges to escalate privileges within the application. The CVSS 3.1 score is 8.2 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, indicating a low-comp...