ui has 8 CVEs on record between 2023 and 2026. The median CVSS is 7.2 (high), with 1 rated critical. 13% have been exploited in the wild — well above the 1% corpus average, so ui flaws are worth patching on sight. The dominant weakness classes are CWE-74 (6) and CWE-77 (6). Most affected products: er-x_firmware (5), argentina_afip_invoices (1), edgemax_edgerouter_firmware (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 13% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —(1)
- Last 90 days
- 0 prev 1
Products
- er-x_firmware 5
- argentina_afip_invoices 1
- edgemax_edgerouter_firmware 1
- unifi_os_server 1
Worst active — by depth score
CVE-2026-34910Critical· 10.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.98CVE-2023-2375High· 7.2A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.653CVE-2025-59467High· 7.5A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page41CVE-2023-2378High· 7.2A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.641CVE-2023-2377High· 7.2A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.641
ui vulnerabilities
CVEs affecting ui, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-34910Critical· 10.0CISA KEVPoCA malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2025-59467High· 7.5A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page
A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator is tricked into visiting a crafted malicious page. This plugin is disabled …
CVE-2023-2378High· 7.2A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be…
CVE-2023-2377High· 7.2A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The at…
CVE-2023-2376High· 7.2A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command inject…
CVE-2023-2375High· 7.2PoCA weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6
A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Executing a manipulation of the argument src can lead to command injection. It is po…
CVE-2023-2374High· 7.2A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6
A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in comman…
CVE-2023-2373High· 7.2A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6
A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The att…