LIVE · cybersecurity feed
Live wire
vendor3 exploited in the wild

Ui

30 CVEs published in the last four months and 12 stories. Exploited flaws first.

Critical11
High19
Medium0
Exploited (KEV)3

Patch these first

CVECVSSSeverityProductSummaryPublished
CVE-2026-34908exploited10criticalunifi os serverA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi153d ago
CVE-2026-34910exploited10criticalunifi os serverA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in Uni153d ago
CVE-2026-34909exploited10criticalunifi os serverA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS device153d ago

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-34908exploited10criticalunifi os serverA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi153d ago
CVE-2026-34910exploited10criticalunifi os serverA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in Uni153d ago
CVE-2026-34909exploited10criticalunifi os serverA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS device153d ago
CVE-2026-5074610criticalunifi connect applicationA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi111d ago
CVE-2026-507489.9criticalunifi accessA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnera111d ago
CVE-2026-507479.9criticalunifi talk applicationA malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Inject111d ago
CVE-2026-544029.9criticalunifi os serverA malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnera111d ago
CVE-2026-551159.9criticalunifi protectA malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF)111d ago
CVE-2026-544009.1criticalunifi accessA malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerab111d ago
CVE-2026-330009.1criticalunifi os serverA malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulner153d ago
CVE-2026-551169criticalunifi connectA malicious actor with access to the network and under certain network configurations could exploit an Improper Ac111d ago
CVE-2026-568418.8highunifi protectA malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulne111d ago
CVE-2026-551148.8highunifi network applicationA malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerabi111d ago
CVE-2026-544048.8highunifi dream machine beast firmwareA malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Inject111d ago
CVE-2026-544068.7highunifi network applicationA malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability foun111d ago
CVE-2026-544078.6highunifi protectA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi111d ago
CVE-2026-544038.6highunifi os serverA malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices111d ago
CVE-2026-544088.6highunifi protectA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi111d ago
CVE-2026-551178.6highunifi accessA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Ap111d ago
CVE-2026-551188.3highunifi network applicationA malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper111d ago
CVE-2026-551198.1highunifi talk applicationA malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerabi111d ago
CVE-2026-349117.7highunifi os serverA malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found153d ago
CVE-2026-544017.7highunifi os serverA malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF)111d ago
CVE-2026-544057.5highunifi network applicationA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in Uni111d ago
CVE-2026-568427.5highunifi network applicationA malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization111d ago
CVE-2026-551117.5highprotect floodlight firmwareA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect F111d ago
CVE-2026-551107.5highunifi os serverA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharin111d ago
CVE-2026-551127.5highunifi dream machine pro firmwareA malicious actor with access to the network and low privileges and under certain conditions could exploit an Impr111d ago
CVE-2026-551137.5highunifi talk applicationA malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability foun111d ago
CVE-2026-544097.5highunifi protectA malicious actor with access to the network and under certain conditions could exploit an Improper Initialization111d ago

Filter the full tracker by Ui →

Our coverage of Ui

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

cybersecurity

AI Fuels Cybersecurity Mergers and Acquisitions

The cybersecurity industry is currently undergoing a substantial wave of mergers and acquisitions (M&A), with 117 deals reported in the most recent quarter. A key driver behind this heightened activity appears to be the increasing integration of artificial intelligence (AI) across various sectors, leading to a broader range of companies seeking to acquire cybersecurity capabilities.

security

Leader of vast money mule operation that laundered cybercriminal proceeds pleads guilty

Oleg Korniev, a 42-year-old dual citizen of Ukraine and Russia, pleaded guilty in U.S. federal court on Thursday to charges related to his leadership of an international money laundering operation known as Your Mule Cashout (YMCO). The organization, active from 2007 to 2014, utilized a network of over 15,000 unwitting money mules across the United States, Germany, Italy, the United Kingdom,…

patchcritical

Even with OT network visibility, critical infrastructure operators struggle with legacy equipment

A recent survey of over 1,600 security and operations leaders in critical infrastructure organizations reveals that despite widespread adoption of security tools, many operators still lack full visibility into their operational technology (OT) networks and struggle with the risks posed by legacy equipment. The study, conducted by Palo Alto Networks, highlights a significant challenge in…

nation-state

Another OpenAI Safety Expert Quits and Raises New AI Safety Concerns

David Robinson, a veteran safety expert at OpenAI, has resigned from the company, citing concerns about its culture and rapid AI development model. Robinson, who was instrumental in authoring safety reports accompanying major product launches during his three-and-a-half-year tenure, stated that he believes the company's current trajectory is unacceptable.

ransomwarehigh

N0n Ransomware Group Emerges, Quickly Targets Victims

A new ransomware operation, dubbed N0n, has reportedly emerged and is actively targeting organizations, according to recent observations. The group has quickly established an online presence, including a dark web leak site where it claims to be publishing data from compromised entities. This rapid operationalization suggests a prepared and potentially well-resourced threat actor.

security

Friday Squid Blogging: EU is Trying to Fight Unregulated Squid Fishing

The European Union is reportedly moving to implement import controls as a measure to combat unregulated squid fishing in the Southwest Atlantic. This initiative aims to address the challenges posed by fishing activities that operate outside established regulatory frameworks in the region.

cloud

EU Cyber Resilience Act requirements for containers and Kubernetes

The European Union's Cyber Resilience Act (CRA), Regulation (EU 2024/2847), will impose mandatory cybersecurity requirements on all digital products sold within EU markets, significantly impacting organizations that develop and distribute containerized applications and Kubernetes deployments. The regulation, which entered into full force on December 10, 2024, will begin its reporting…

nation-state

Security Affairs newsletter Round 595 by Pierluigi Paganini – INTERNATIONAL EDITION

CenterPoint Energy, a Texas-based utility provider, has confirmed a data breach following claims by a hacker that they had stolen 7.49 million customer records. The company acknowledged that an unauthorized intruder accessed customer information.

security

Friday Squid Blogging: On Squid Egg Sacs

A recent blog post discussed the biological topic of squid egg sacs, while also serving as an open thread for readers to discuss security news not covered elsewhere on the site. The post itself focused on the natural history of squid reproduction, specifically the structures known as egg sacs.

security

Early Scattered Spider member pleads guilty to cybercrime spree

Ahmed Hossam Eldin Elbadawy, a 24-year-old from Texas, has pleaded guilty to federal charges of wire fraud conspiracy and aggravated identity theft. Elbadawy, identified as an early member of the cybercrime group "Scattered Spider," entered his plea a year ago, but the details were not made public until prosecutors filed an order of forfeiture this week.

malware

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Cybersecurity researchers have uncovered a new JavaScript stealer, dubbed WeaselBiscuit, which is being distributed through 13 malicious npm packages. The stealer's primary objective is to exfiltrate data from Chrome extension storage. This discovery highlights an ongoing threat vector targeting developers and users within the JavaScript ecosystem.