CVE-2026-93328 is a critical vulnerability in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. The issue is fixed in version 1.5.0.
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query.
This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732
CVE-2026-65184 is a critical OS command injection vulnerability in the Vertiv Avocent ACS8000 appliance. The root-privileged wsserver terminal-bridge daemon constructs shell commands from client-supplied WebSocket fields and executes them via system() and popen() calls without proper sanitization. This allows unauthenticated remote attackers to execute arbitrary commands with root privileges. The vulnerability affects versions from 0 up to and including 2.32.4. No public exploits or patches are currently documented.
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA certificates. This issue impacts MongoDB Shell (mongosh) versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0 which bundles Node.js 24.22.1 or later. If mongosh is installed through npm, it uses the Node.js runtime installed on the host; update that runtime separately.
A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
Mattermost versions up to 11.9, 11.1.9, 11.5.8, and 11.10.7.0 contain a vulnerability where the Zoom chat line length is not properly validated before slicing. This improper check can be exploited by an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription with short continuation lines.
CVE-2026-97200 is a high-severity vulnerability in the benoitc hackney HTTP client library affecting versions from 2.0.0-beta.1 up to but not including 4.9.0. It involves improper handling of highly compressed or oversized HTTP response bodies, allowing a malicious server to exhaust client memory by sending a large or compressed response that is buffered and decompressed without limits. This can lead to resource exhaustion on the client side. The issue is fixed in version 4.9.0.
CVE-2026-115693 is an improper certificate validation vulnerability in the hackney_ssl module of benoitc hackney. It allows an on-path attacker to impersonate a server pinned to a private certificate authority by exploiting the acceptance of certificate chains ending in a publicly trusted root. The hostname check remains enforced, requiring the attacker to have a publicly trusted certificate for the pinned hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.
CVE-2026-113440 is a vulnerability in the benoitc hackney HTTP client library versions from 2.0.0 up to but not including 4.9.0. It allows a redirecting server to capture basic authentication and cookie credentials when a redirect occurs on the same host but changes scheme (e.g., HTTPS to HTTP) or port. This happens because the library reissues requests with credentials after comparing only the hostname, exposing sensitive headers in cleartext or to unintended services.
CVE-2026-115700 is a Server Side Request Forgery (SSRF) vulnerability in the benoitc hackney library affecting versions from 4.0.1 up to but not including 4.9.0. The flaw arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots, allowing bypass of allowlist checks and unintended connections to internal IP addresses. This issue was introduced as a fix attempt for a previous vulnerability (CVE-2026-47076) but still allows certain malformed IP literals to bypass validation. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9 and is fixed in version 4.9.0.
CVE-2026-112880 is an HTTP Request/Response Splitting vulnerability in the hackney HTTP client library. It occurs because the proxy_auth_fun callback's return value is written into the Proxy-Authorization header without sanitization, allowing injection of CR, LF, or NUL bytes. This can lead to additional header lines being added to requests sent to an HTTP CONNECT proxy. The issue affects hackney versions from 2.0.0 up to but not including 4.9.0 and was fixed in version 4.9.0.
CVE-2026-116283 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19. The flaw exists in the Local API component, specifically in the /profiles file, and can be exploited remotely. Upgrading to version 5.2.0 mitigates this issue.
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
Harbor versions prior to 2.15.3, 2.14.5, and 2.13.6 contain a Server-Side Request Forgery (SSRF) vulnerability in the webhook delivery component. An authenticated attacker with ProjectAdmin permissions can configure webhooks to target internal private or link-local IP addresses. When triggered, Harbor's jobservice makes unauthenticated HTTP POST requests to these targets. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata.
CVE-2026-108529 is an inefficient algorithmic complexity vulnerability in the HTTP/2 implementation of the mtrudel bandit server. An unauthenticated remote attacker can exhaust the server CPU by sending many small SETTINGS or connection-level WINDOW_UPDATE frames, causing the server to perform costly O(n²) operations when retrying blocked sends. This affects bandit versions from 0.3.4 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
A critical vulnerability (CVE-2026-59107) exists in the vSolution Matrix file sharing feature of WolfVision Cynap Pro and Cynap Core Pro devices configured as main/master stations. The flaw involves a shared cryptographic trust configuration that could allow an attacker with the matching private key to authenticate via SSH as root. This affects versions prior to 1.78a and version 0. A fix is available in version 1.78a.
CVE-2026-110499 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.6 up to but not including 1.14.0. It involves allocation of resources without limits or throttling, where an unauthenticated remote attacker can cause unbounded growth in per-connection memory and CPU usage by specifying a large SETTINGS_HEADER_TABLE_SIZE. This leads to quadratic CPU cost per connection due to the HPACK encoder table resizing and linear scanning of response headers. The issue is fixed in version 1.14.0.
This content is a thematic cybersecurity analysis using Christopher Nolan's film adaptation of The Odyssey as an allegory to illustrate various cybersecurity concepts and threats. It draws parallels between characters and events in the story and common cyber threats such as ransomware, Trojan horses, VPN usage, social engineering, DDoS attacks, and advanced persistent threats (APTs). The narrative uses metaphorical language to educate about digital hygiene and security principles rather than describing an actual technical vulnerability or active threat.
CVE-2026-109584 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit that allows unauthenticated remote attackers to exhaust server memory. The flaw arises from improper handling of highly compressed HPACK HEADERS blocks, where a small compressed block can cause excessive memory allocation by repeatedly referencing a large cookie value. This affects bandit versions from 0.3.3 up to but not including 1.14.0. The issue is fixed in version 1.14.0.