HIGHVulnerability
Verified
Global

CISA KEV: Ubiquiti UniFi OS — Ubiquiti UniFi OS Improper Input Validation Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.

Analysis

Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection. Added to CISA Known Exploited Vulnerabilities catalog on 2026-06-23. Remediation due: 2026-06-26.

Indicators of Compromise (1)

CVE (1)
CVE-2026-34910
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Jun 23, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerability

Chinese Framework Powers 200,000 Scam Sites

Threat actors are selling investment scam templates created using the legitimate DCloud Uni-App toolkit. The post Chinese Framework Powers 200,000 Scam Sites appeared first on SecurityWeek .

SecurityWeek
MEDIUMVulnerability

NAIC suspends investment risk designations after cyber attack

The National Association of Insurance Commissioners (NAIC) is the U.S. standard-setting and regulatory support organization. It is governed by the chief insurance regulators from the 50 states, the District of Columbia, and five U.S. territories. The organization serves the public interest by setting standards and regulatory best practices, acting as a forum to exchange information,... Source

DataBreaches.net
CRITICALVulnerability

NVD CRITICAL: CVE-2026-12415 — The Invoice Generator plugin for WordPress is vulnerable to privilege escalation...

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentic

CVE-2026-12415
NIST NVD