CVE-2026-34911

HighCVSS 7.7/10Last modified Jul 23, 2026

Description

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-349124.3A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and CVE-2026-349134.3A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl CVE-2026-349148.3A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploi CVE-2026-349156.1A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349168.8A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349174.3Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict CVE-2026-34926.4The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is CVE-2026-349266.7A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table CVE-2026-349277.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349287.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349297.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349307.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.