Ubiquiti UniFi

productDE

cpe:/a:ubnt:unifi:-

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

3critical4high1medium0low

updated 2026-10-27

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-50746US	—	1.69% (77th)	Exploit	no fix	2026-07-02	—
CVE-2026-54402US	high8.8	1.76% (78th)	—	no fix	2026-07-02	—
CVE-2026-50748US	—	1.63% (76th)	—	no fix	2026-07-02	—
CVE-2026-54403US	—	0.77% (56th)	—	no fix	2026-07-02	—
CVE-2026-54406US	—	0.59% (48th)	—	no fix	2026-07-02	—
CVE-2026-54408US	critical9.8	0.57% (47th)	—	no fix	2026-07-02	—
CVE-2026-55117US	—	0.56% (46th)	—	no fix	2026-07-02	—
CVE-2026-54400US	—	0.52% (44th)	—	no fix	2026-07-02	—
CVE-2026-54405US	—	0.52% (44th)	—	no fix	2026-07-02	—
CVE-2026-55111US	—	0.50% (43rd)	—	no fix	2026-07-02	—
CVE-2026-56841US	—	0.49% (42nd)	—	no fix	2026-07-02	—
CVE-2026-54404US	—	0.49% (42nd)	—	no fix	2026-07-02	—
CVE-2026-50747US	—	0.49% (42nd)	—	no fix	2026-07-02	—
CVE-2026-55115US	critical9.9	0.47% (40th)	—	no fix	2026-07-02	—
CVE-2026-55114US	—	0.47% (40th)	—	no fix	2026-07-02	—
CVE-2026-54407US	—	0.45% (39th)	—	no fix	2026-07-02	—
CVE-2026-54409US	high8.1	0.44% (38th)	—	no fix	2026-07-02	—
CVE-2026-54401US	high8.8	0.43% (37th)	—	no fix	2026-07-02	—
CVE-2026-55116US	critical9.8	0.41% (35th)	—	no fix	2026-07-02	—
CVE-2026-55119US	—	0.39% (32nd)	—	no fix	2026-07-02	—
CVE-2026-55113US	—	0.37% (31st)	—	no fix	2026-07-02	—
CVE-2026-55118US	—	0.37% (30th)	—	no fix	2026-07-02	—
CVE-2026-56842US	—OT elevated	0.36% (30th)	—	no fix	2026-07-02	—
CVE-2026-55112US	high8.8	0.36% (29th)	—	no fix	2026-07-02	—
CVE-2026-55110US	medium6.1	0.27% (19th)	—	no fix	2026-07-02	—

The flaw types (CWEs) most of these CVEs share.

CWE-284Improper Access Control9 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')3 CVEs
CWE-918Server-Side Request Forgery (SSRF)3 CVEs
CWE-665Improper Initialization1 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')1 CVEs
CWE-863Incorrect Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.