CVE-2026-56841

HighCVSS 8.8/10Last modified Jul 6, 2026

Description

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jul 2, 2026
Last modified
Jul 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-568427.5A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UnCVE-2026-568439.9Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domaiCVE-2026-568448.4A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges andCVE-2026-568457.5An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. ByCVE-2026-568467.5A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. ThiCVE-2026-568476.1A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. CVE-2026-568487.5A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executCVE-2026-56858.8A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The maniCVE-2026-568504.4A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to beCVE-2026-568517.5The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.CVE-2026-568527.5A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.CVE-2026-568537.5When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 c
CVE-2026-56841: High severity, CVSS 8.8 | Vulnix