Express
Monthly
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by injecting CRLF sequences, granting full control over the appliance under certain conditions. It affects a broad range of UniFi OS platforms including Cloud Gateways, Dream Machines/Routers, Cloud Keys, and Enterprise NVR/NAS hardware. Reported by Ubiquiti with a CVSS of 9.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the high scope-changing impact makes it a priority to patch.
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitrary OS commands on UniFi gateways, controllers, NVRs, and NAS devices, with a CVSS 9.9 score reflecting scope change and full CIA impact. The vulnerability affects a broad device family including UDM, UDM Pro/SE/Max/Beast, UDR, UDW, UCG, UNVR, and UNAS lines per Ubiquiti Security Advisory Bulletin 065. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on affected UniFi OS devices and instances due to improper input validation (CWE-20). The CVSS 9.9 score reflects a scope-changing impact spanning UniFi Dream Machine, UniFi Express, UDR, UCG, UNVR, UNAS, and other UniFi OS Server platforms. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive data via a path traversal flaw (CWE-22). The high CVSS 8.6 score reflects a scope change with high confidentiality impact, indicating that disclosed data can affect resources beyond the vulnerable component itself. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected cross-site scripting (XSS) in Smoothwall Express versions before 3.1 Update 13 allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers by crafting malicious URLs with javascript: schemes and delivering them through the unsanitized /redirect.cgi endpoint. The vulnerability requires user interaction (clicking a malicious link) and results in limited scope impact affecting user confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Smoothwall Express prior to version 3.1 Update 13 allows authenticated attackers to inject arbitrary JavaScript through the VPN_IP parameter in /cgi-bin/vpnmain.cgi, which executes when other users view affected VPN configuration pages. The vulnerability requires user interaction (page view) and authenticated access, limiting immediate risk but enabling persistent session hijacking or credential theft against administrative users. No public exploit code or active exploitation has been confirmed at the time of analysis.
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 through 2.0.0 where an attacker can crash the application process by uploading a file with an empty string field name, triggering an unhandled exception. The vulnerability has a CVSS score of 8.7 indicating high severity, though the impact is limited to availability (DoS) rather than confidentiality or integrity. No active exploitation or public POC has been confirmed at this time, but the low attack complexity and network accessibility make this a practical DoS vector for any exposed Multer instance.
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Express.js minimalist web framework for node. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Express.js minimalist web framework for node. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.
Unauthenticated network attackers can crash Ubiquiti UniFi gateway devices by sending crafted traffic that triggers an out-of-bounds write (CWE-787) in the affected firmware, producing a denial-of-service condition that can take the device offline or force a reboot. Tracked as CVE-2026-95862 with a CVSS 3.1 score of 7.5 (HIGH) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, the flaw is reachable over the network without credentials or user interaction, but its impact is confined entirely to availability - no confidentiality or integrity loss, and no code execution or data disclosure is indicated. Affected product families per the vendor's CPE data include Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways; so far there is no public exploit identified at time of analysis and the issue has not been marked as confirmed actively exploited (CISA KEV).
Denial of service in Ubiquiti UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways) allows an unauthenticated remote attacker reachable over the network to crash the device by triggering uncontrolled recursion (CWE-674), rated CVSS 3.1 base 7.5 HIGH with impact confined to availability (C:N/I:N/A:H). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials or user interaction are required and complexity is low; the practical gating factor is exposure of the affected service, so gateways with management/service interfaces reachable from the internet or untrusted networks are directly at risk while LAN-confined deployments are exploitable only by a host already on that segment. The outcome is limited to device crash/reboot with no data exposure or code execution; no public exploit identified at time of analysis and no KEV or EPSS data was provided.
Unauthenticated network attackers who can reach an affected Ubiquiti UniFi gateway can trigger an out-of-bounds read (CWE-125) that crashes the device, producing a denial-of-service condition rated 7.5 HIGH. The issue affects the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express/Express 7, and generic UniFi Gateway product lines, and no public exploit code was identified at time of analysis. Because the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no credentials, user interaction, or special configuration are required - the practical constraint is network exposure, since the attack surface shrinks considerably if the vulnerable service is bound only to a trusted LAN or management interface rather than the WAN or untrusted segments.
Denial of service in UniFi gateway devices (Dream Machines, Dream Routers, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and other UniFi gateways) can be triggered by an unauthenticated network attacker who sends crafted input to a vulnerable interface, causing an out-of-bounds read (CWE-125) that crashes the device. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is network-reachable, low-complexity, and requires no authentication or user interaction, but impact is limited to availability with no confidentiality or integrity loss. Exploitation requires the attacker to reach the exposed vulnerable service; if the affected parser listens only on LAN or management interfaces rather than the WAN, an internet-based attacker would need a foothold. No public exploit code or active exploitation has been identified at time of analysis.
Network-reachable out-of-bounds write in Ubiquiti UniFi gateway devices-including Dream Machine, Dream Router, Dream Wall, Cloud Gateways, Enterprise Firewalls, Express, Express 7, and UniFi Gateways-allows unauthenticated remote attackers to crash the device, causing a denial of service. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning availability-only impact with no confidentiality or integrity loss. No public exploit identified at time of analysis; Ubiquiti Security Advisory Bulletin 069 provides remediation guidance.
Unauthenticated remote attackers who can reach the network-facing services of certain Ubiquiti UniFi gateway devices can trigger an out-of-bounds write that crashes the device, producing a denial-of-service condition (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). The affected product lines span the Dream Machine, Dream Router, Dream Wall, Cloud Gateway, Enterprise Firewall, Express, Express 7 and general UniFi Gateway families, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exposure is bounded by network position: the CVSS vector confirms no authentication or user interaction is required, but the attacker must still be able to send traffic to the vulnerable service, so gateways whose attack surface is confined to trusted internal segments are materially less exposed than devices reachable from the WAN or other untrusted networks.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralization of CRLF sequences (CWE-93) to gain access to affected consoles and gateways. It impacts a broad line of UniFi OS devices - Cloud Keys, Dream Machines/Routers, Network Video Recorders, Cloud Gateways, Enterprise Firewall/Fortress and NAS appliances, and the UniFi OS Server. Vendor-rated CVSS 10.0; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by injecting CRLF sequences, granting full control over the appliance under certain conditions. It affects a broad range of UniFi OS platforms including Cloud Gateways, Dream Machines/Routers, Cloud Keys, and Enterprise NVR/NAS hardware. Reported by Ubiquiti with a CVSS of 9.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the high scope-changing impact makes it a priority to patch.
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitrary OS commands on UniFi gateways, controllers, NVRs, and NAS devices, with a CVSS 9.9 score reflecting scope change and full CIA impact. The vulnerability affects a broad device family including UDM, UDM Pro/SE/Max/Beast, UDR, UDW, UCG, UNVR, and UNAS lines per Ubiquiti Security Advisory Bulletin 065. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on affected UniFi OS devices and instances due to improper input validation (CWE-20). The CVSS 9.9 score reflects a scope-changing impact spanning UniFi Dream Machine, UniFi Express, UDR, UCG, UNVR, UNAS, and other UniFi OS Server platforms. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive data via a path traversal flaw (CWE-22). The high CVSS 8.6 score reflects a scope change with high confidentiality impact, indicating that disclosed data can affect resources beyond the vulnerable component itself. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected cross-site scripting (XSS) in Smoothwall Express versions before 3.1 Update 13 allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers by crafting malicious URLs with javascript: schemes and delivering them through the unsanitized /redirect.cgi endpoint. The vulnerability requires user interaction (clicking a malicious link) and results in limited scope impact affecting user confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Smoothwall Express prior to version 3.1 Update 13 allows authenticated attackers to inject arbitrary JavaScript through the VPN_IP parameter in /cgi-bin/vpnmain.cgi, which executes when other users view affected VPN configuration pages. The vulnerability requires user interaction (page view) and authenticated access, limiting immediate risk but enabling persistent session hijacking or credential theft against administrative users. No public exploit code or active exploitation has been confirmed at the time of analysis.
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 through 2.0.0 where an attacker can crash the application process by uploading a file with an empty string field name, triggering an unhandled exception. The vulnerability has a CVSS score of 8.7 indicating high severity, though the impact is limited to availability (DoS) rather than confidentiality or integrity. No active exploitation or public POC has been confirmed at this time, but the low attack complexity and network accessibility make this a practical DoS vector for any exposed Multer instance.
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Express.js minimalist web framework for node. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Express.js minimalist web framework for node. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.