#CVSS 9.1
All CosmicBytez Labs articles tagged #CVSS 9.1, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-15265: Tenable Agent Path Traversal — Arbitrary File Write & RCE (CVSS 9.1)
A critical path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and earlier allows a privileged attacker to write arbitrary files outside the...
- Security
CVE-2026-53469: migration-planner Missing Authorization on Bulk Delete
A critical missing authorization vulnerability (CVSS 9.1) in Red Hat's migration-planner allows any authenticated user to send a DELETE request to...
- Security
CVE-2026-4035: MLflow AI Gateway Credential Exfiltration via Env Variable Resolution
A CVSS 9.1 critical flaw in MLflow AI Gateway allows server-side environment variables in api_key fields to be resolved and exfiltrated to attacker-controlled…
- Security
CVE-2026-48188: OTRS Database Layer SQL Injection — Authentication Bypass
A critical SQL injection vulnerability (CVSS 9.1) in OTRS and ((OTRS)) Community Edition allows unauthenticated attackers to bypass authentication entirely…
- Security
CVE-2026-4290: WP Travel Pro Arbitrary User Deletion via Broken REST API Access Control
A critical CVSS 9.1 access control flaw in the WP Travel Pro WordPress plugin allows unauthenticated attackers to delete any user account — including...
- Security
UniFi OS Command Injection via Improper Input Validation
A CVSS 9.1 command injection vulnerability in UniFi OS devices allows a network-adjacent attacker with high privileges to execute arbitrary commands on...
- Security
CVE-2026-5433: Honeywell CNM Critical Command Injection RCE
A CVSS 9.1 critical command injection vulnerability in Honeywell's Control Network Module web interface allows remote attackers to execute arbitrary...
- Security
CVE-2026-31986: Apache OFBiz Hard-Coded Cryptographic Key
Apache OFBiz versions before 24.09.06 contain a hard-coded cryptographic key vulnerability (CVSS 9.1) that allows attackers to forge authentication tokens...
- Security
CVE-2026-26026: GLPI Template Injection Enables
GLPI versions 11.0.0 through 11.0.5 contain a server-side template injection vulnerability in the administrator interface that allows authenticated admins...