#CVSS 9.9
All CosmicBytez Labs articles tagged #CVSS 9.9, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-120230: WAVLINK WN701AE del_vlan_group OS Command Injection
A CVSS 9.9 command injection in the WAVLINK WN701AE web backend (del_vlan_group, vlan_name) is remotely exploitable and a public exploit exists.
- Security
CVE-2026-120231: WAVLINK WN553X1-B OpenVPN Handler Command Injection
A CVSS 9.9 OS command injection in the WAVLINK WN553X1-B OpenVPN CLI handler (sub_416568, file_id) is remotely exploitable with a public exploit.
- Security
CVE-2026-120238: WAVLINK WN553X1-B ovpn_file Handler Command Injection
A CVSS 9.9 OS command injection in the WAVLINK WN553X1-B ovpn_file handler (sub_4162A8, file_id) is remotely exploitable and the exploit is disclosed.
- Security
CVE-2026-120239: WAVLINK WN553X1-B WireGuard CLI Handler Command Injection
A CVSS 9.9 OS command injection in the WAVLINK WN553X1-B WireGuard CLI handler (sub_419DA8, file_id) is remotely exploitable; exploit details are public.
- Security
CVE-2026-120240: WAVLINK WN553X1-B WireGuard Group Handler Command Injection
A CVSS 9.9 OS command injection in the WAVLINK WN553X1-B WireGuard group handler (sub_41A748, group_id/group_name) is remotely exploitable.
- Security
CVE-2026-14450: MaaS API Auth Bypass via Forged HTTP Headers
A critical CVSS 9.9 flaw in the MaaS API allows any pod within a Kubernetes cluster to bypass the Kuadrant AuthPolicy gateway by forging X-MaaS-Username...
- Security
CVE-2026-18948: Feast Feature Store RCE via Unsafe Deserialization
A critical CVSS 9.9 vulnerability in the Feast ML feature store allows unauthenticated remote code execution through malicious user-defined functions...
- Security
CVE-2025-14771: ABB T-MAC Plus Critical File & Directory Exposure (CVSS 9.9)
A CVSS 9.9 critical vulnerability in ABB T-MAC Plus v4.0-24 exposes internal files and directories to external parties, allowing unauthenticated attackers to…
- Security
CVE-2026-40453: Apache Camel Header Filter Case-Variant
A critical incomplete fix in Apache Camel leaves five non-HTTP HeaderFilterStrategy implementations vulnerable to case-variant header injection, allowing...