CVE-2026-93328 is a critical vulnerability in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. The issue is fixed in version 1.5.0.
A SQL Injection vulnerability exists in the sql-storage module of Apache SIS versions 1.0 through 1.6.0. The issue occurs when sorting a stream of features, where the ORDER BY clause copies the sort clause without quoting the identifier, allowing crafted input to inject SQL code. This vulnerability is fixed in Apache SIS version 1.7.
CVE-2026-93847 is an authorization vulnerability in Mattermost versions 11.7.0 through 11.7.10. It occurs because these versions fail to properly validate reserved system post types during scheduled post creation and publication. This flaw allows an authenticated channel member to publish messages that appear as trusted system events via the scheduled post endpoint.
CVE-2026-65184 is a critical OS command injection vulnerability in the Vertiv Avocent ACS8000 appliance. The root-privileged wsserver terminal-bridge daemon constructs shell commands from client-supplied WebSocket fields and executes them via system() and popen() calls without proper sanitization. This allows unauthenticated remote attackers to execute arbitrary commands with root privileges. The vulnerability affects versions from 0 up to and including 2.32.4. No public exploits or patches are currently documented.
CVE-2026-115930 is a high-severity vulnerability in MongoDB Shell (mongosh) versions prior to 2.14.0. It involves improper certificate validation due to the inclusion of recoverable eMudhra intermediate CA certificates in the Node.js TLS root certificate store used by mongosh. This can be mitigated by updating mongosh to version 2.14.0 or later, which bundles a fixed Node.js runtime version 24.22.1 or newer. If mongosh is installed via npm, the Node.js runtime on the host must be updated separately.
Kameleo versions 5.3.0 and 5.3.1 contain an information disclosure vulnerability in the Local API component, specifically in the /general/user-info endpoint. This flaw allows remote attackers to obtain sensitive information without authentication. The vendor has not responded to disclosure attempts and no patch or fix is currently available.
Mattermost versions up to 11.9, 11.1.9, 11.5.8, and 11.10.7.0 contain a vulnerability where the Zoom chat line length is not properly validated before slicing. This improper check can be exploited by an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription with short continuation lines.
CVE-2026-97200 is a high-severity vulnerability in the benoitc hackney HTTP client library affecting versions from 2.0.0-beta.1 up to but not including 4.9.0. It involves improper handling of highly compressed or oversized HTTP response bodies, allowing a malicious server to exhaust client memory by sending a large or compressed response that is buffered and decompressed without limits. This can lead to resource exhaustion on the client side. The issue is fixed in version 4.9.0.
CVE-2026-115693 is an improper certificate validation vulnerability in the hackney_ssl module of benoitc hackney. It allows an on-path attacker to impersonate a server pinned to a private certificate authority by exploiting the acceptance of certificate chains ending in a publicly trusted root. The hostname check remains enforced, requiring the attacker to have a publicly trusted certificate for the pinned hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.
CVE-2026-113440 is a vulnerability in the benoitc hackney HTTP client library versions from 2.0.0 up to but not including 4.9.0. It allows a redirecting server to capture basic authentication and cookie credentials when a redirect occurs on the same host but changes scheme (e.g., HTTPS to HTTP) or port. This happens because the library reissues requests with credentials after comparing only the hostname, exposing sensitive headers in cleartext or to unintended services.
CVE-2026-115700 is a Server Side Request Forgery (SSRF) vulnerability in the benoitc hackney library affecting versions from 4.0.1 up to but not including 4.9.0. The flaw arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots, allowing bypass of allowlist checks and unintended connections to internal IP addresses. This issue was introduced as a fix attempt for a previous vulnerability (CVE-2026-47076) but still allows certain malformed IP literals to bypass validation. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9 and is fixed in version 4.9.0.
CVE-2026-112880 is an HTTP Request/Response Splitting vulnerability in the hackney HTTP client library. It occurs because the proxy_auth_fun callback's return value is written into the Proxy-Authorization header without sanitization, allowing injection of CR, LF, or NUL bytes. This can lead to additional header lines being added to requests sent to an HTTP CONNECT proxy. The issue affects hackney versions from 2.0.0 up to but not including 4.9.0 and was fixed in version 4.9.0.
CVE-2026-116283 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19. The flaw exists in the Local API component, specifically in the /profiles file, and can be exploited remotely. Upgrading to version 5.2.0 mitigates this issue.
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
Harbor versions prior to 2.15.3, 2.14.5, and 2.13.6 contain a Server-Side Request Forgery (SSRF) vulnerability in the webhook delivery component. An authenticated attacker with ProjectAdmin permissions can configure webhooks to target internal private or link-local IP addresses. When triggered, Harbor's jobservice makes unauthenticated HTTP POST requests to these targets. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata.
CVE-2026-108529 is an inefficient algorithmic complexity vulnerability in the HTTP/2 implementation of the mtrudel bandit server. An unauthenticated remote attacker can exhaust the server CPU by sending many small SETTINGS or connection-level WINDOW_UPDATE frames, causing the server to perform costly O(n²) operations when retrying blocked sends. This affects bandit versions from 0.3.4 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
A critical vulnerability (CVE-2026-59107) exists in the vSolution Matrix file sharing feature of WolfVision Cynap Pro and Cynap Core Pro devices configured as main/master stations. The flaw involves a shared cryptographic trust configuration that could allow an attacker with the matching private key to authenticate via SSH as root. This affects versions prior to 1.78a and version 0. A fix is available in version 1.78a.
CVE-2026-110499 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.6 up to but not including 1.14.0. It involves allocation of resources without limits or throttling, where an unauthenticated remote attacker can cause unbounded growth in per-connection memory and CPU usage by specifying a large SETTINGS_HEADER_TABLE_SIZE. This leads to quadratic CPU cost per connection due to the HPACK encoder table resizing and linear scanning of response headers. The issue is fixed in version 1.14.0.
This content is a thematic cybersecurity analysis using Christopher Nolan's film adaptation of The Odyssey as an allegory to illustrate various cybersecurity concepts and threats. It draws parallels between characters and events in the story and common cyber threats such as ransomware, Trojan horses, VPN usage, social engineering, DDoS attacks, and advanced persistent threats (APTs). The narrative uses metaphorical language to educate about digital hygiene and security principles rather than describing an actual technical vulnerability or active threat.
CVE-2026-109584 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit that allows unauthenticated remote attackers to exhaust server memory. The flaw arises from improper handling of highly compressed HPACK HEADERS blocks, where a small compressed block can cause excessive memory allocation by repeatedly referencing a large cookie value. This affects bandit versions from 0.3.3 up to but not including 1.14.0. The issue is fixed in version 1.14.0.