CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.02)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
In Progress Flowmon versions prior to 12.5.9 and 13.0.11, an authenticated low-privileged user can craft a request during PDF generation, leading to operations performed with another user's privileges. This may result in unauthorized access to sensitive data and unintended system configuration changes.
An Incorrect Authorization vulnerability in UniFi Network Application allows a malicious actor with network access to persist privileges after such access has been removed, under certain conditions.
An authenticated SQL Injection vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to escalate privileges on the host device.
An Improper Access Control vulnerability in UniFi Talk Application allows privilege escalation. An attacker with network access and low privileges can exploit this flaw.
A vulnerability in UniFi Network Application allows privilege escalation by an attacker with network access and low privileges, under certain conditions. The issue stems from improper access control.
A Path Traversal vulnerability in UniFi Access Application allows a malicious actor with network access to read files on the host device.
A vulnerability in UniFi Network Application allows an attacker with network access and low privileges to escalate privileges through improper access control.
An SSRF vulnerability in UniFi Talk Application allows an attacker with network access to perform a DoS attack and bypass authentication on certain API endpoints.
A vulnerability in UniFi OS with UniFi Protect Application allows privilege escalation on the host device. The flaw is due to improper access control, which can be exploited by a malicious actor with network access and low privileges under certain conditions.
A Path Traversal vulnerability in UniFi Protect Floodlight devices allows an attacker with network access to read files on the device.
A vulnerability in UniFi OS is caused by a misconfigured CORS policy, allowing an attacker to lure an authenticated user to a malicious page and trigger actions in the system using that user's session.
A vulnerability in the UniFi Protect Application allows an attacker with network access, under certain conditions, to bypass authentication in UniFi Protect Cameras due to improper initialization.
A vulnerability in UniFi Protect Application allows an attacker with network access to bypass authentication for data streaming due to improper access control.
An Improper Access Control vulnerability in UniFi Protect Application allows a network-accessible attacker to bypass authentication in certain API endpoints.
A Path Traversal vulnerability in self-hosted instances of UniFi Network Application allows an attacker with network access and high privileges to escalate write permissions on the host device.
A vulnerability in UniFi Network Application allows an attacker with network access to execute a Denial of Service (DoS) attack through improper input validation.
An SQL Injection vulnerability in UniFi OS allows an attacker with network access and low privileges to escalate privileges on the affected device or instance.
A Path Traversal vulnerability in devices running UniFi OS allows an attacker with network access to bypass authentication. The flaw affects specific UniFi OS devices or instances.
An SSRF vulnerability in UniFi OS allows an attacker with network access and low privileges to escalate privileges on the device or instance.
In the Linux kernel, a vulnerability exists in the Bluetooth L2CAP stack. The cleanup_listen() function closes channels directly, which can lead to lock inversion. The fix uses a channel timer to close channels asynchronously, ensuring correct lock ordering and preventing potential deadlocks.