CVE Intelligence
Home / CVEs

Exploited vulnerabilities (CISA KEV)

CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.

Severity
Clear

4 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-34908 Critical · 10.0 KEV Urgent · 73 Public exploit CWE-284 May 21, 2026
Ubiquiti UniFi OS Improper Access Control Vulnerability
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
CVE-2026-34909 Critical · 10.0 KEV High · 60 CWE-22 May 21, 2026
Ubiquiti UniFi OS Path Traversal Vulnerability
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
CVE-2026-34910 Critical · 10.0 KEV Urgent · 73 Public exploit CWE-20 May 21, 2026
Ubiquiti UniFi OS Improper Input Validation Vulnerability
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2010-5330 Critical · 9.8 KEV High · 63 CWE-77 Jun 11, 2019
Ubiquiti AirOS Command Injection Vulnerability
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.