#CVSS 10
All CosmicBytez Labs articles tagged #CVSS 10, across news, security advisories, how-to guides, and projects.
- News
Metabase SQLi Zero-Day Exploited in Customer Data-Theft Attacks
A CVSS 10.0 unauthenticated SQL injection zero-day in Metabase's open-source analytics platform was actively exploited against cloud and self-hosted...
- Security
CVE-2026-48276: Adobe ColdFusion Critical File Upload RCE (CVSS 10.0)
Adobe ColdFusion versions 2023.20 and 2025.9 and earlier contain a critical unrestricted file upload vulnerability that allows unauthenticated remote...
- Security
CVE-2026-48277: Adobe ColdFusion Critical Input Validation RCE (CVSS 10.0)
Adobe ColdFusion versions 2023.20 and 2025.9 and earlier contain an improper input validation vulnerability enabling unauthenticated remote code...
- Security
CVE-2026-48281: Adobe ColdFusion Input Validation RCE Zero-Day (CVSS 10.0)
A second critical improper input validation flaw in Adobe ColdFusion allows unauthenticated remote code execution in the context of the current user. Part...
- Security
CVE-2026-48282: Adobe ColdFusion Critical Path Traversal to RCE (CVSS 10.0)
Adobe ColdFusion contains a critical path traversal vulnerability (CWE-22) that enables unauthenticated remote code execution. The flaw is part of Adobe's...
- Security
CVE-2026-10520: Ivanti Sentry OS Command Injection — CVSS 10.0
A maximum-severity OS command injection vulnerability in Ivanti Sentry allows unauthenticated remote attackers to achieve root-level code execution. Patch...
- News
Ubiquiti Patches Three Max-Severity UniFi OS Vulnerabilities
Ubiquiti has released security updates fixing three CVSS 10.0 vulnerabilities in UniFi OS that allow unauthenticated remote attackers to fully compromise...
- Security
CVE-2026-20223: Cisco Secure Workload REST API Auth Bypass
A CVSS 10.0 authentication bypass in Cisco Secure Workload allows unauthenticated remote attackers to access internal REST APIs with full Site Admin privileges.
- Security
CVE-2026-42960 — NLnet Labs Unbound DNS Cache Poisoning
A perfect-10 CVSS vulnerability in NLnet Labs Unbound allows adversaries to poison the DNS resolver cache using promiscuous records injected into the...
- Security
CVE-2026-34234 — CtrlPanel Installer Unauthenticated Remote
A CVSS 10.0 RCE vulnerability in CtrlPanel's web-based installer allows unauthenticated attackers to execute arbitrary code by exploiting a logic flaw...
- Security
CVE-2026-35051: Traefik ForwardAuth Authentication Bypass
A critical CVSS 10.0 authentication bypass in Traefik's ForwardAuth middleware allows attackers to circumvent authentication when the proxy is deployed...
- Security
CVE-2026-39858: Traefik Forwarded-Header Sanitization
A second critical CVSS 10.0 authentication bypass in Traefik allows attackers to defeat ForwardAuth and snippet-based authentication middleware by...
- Security
CVE-2017-20230: Perl Storable Stack Overflow — CVSS 10.0
A stack overflow vulnerability in Perl's Storable module (versions before 3.05) stems from a signed/unsigned integer mismatch in retrieve_hook(), enabling...
- Security
CVE-2025-15638: Net::Dropbear Bundles Vulnerable
Net::Dropbear versions before 0.14 for Perl ship with Dropbear 2019.78 or earlier, which includes libtomcrypt v1.18.1 — a library affected by two known...
- Security
Juju Dqlite Cluster TLS Auth Bypass — Unauthenticated
A CVSS 10.0 critical vulnerability in Juju versions 3.2.0–3.6.18 and 4.0–4.0.3 allows unauthenticated attackers to connect directly to the internal Dqlite...
- Security
Critical n8n Vulnerability (CVSS 10.0) Enables Complete
A maximum-severity flaw dubbed 'Ni8mare' in the popular workflow automation platform n8n allows unauthenticated attackers to gain full control of...