CVE-2026-113440 is a vulnerability in the benoitc hackney HTTP client library versions from 2.0.0 up to but not including 4.9.0. It allows a redirecting server to capture basic authentication and cookie credentials when a redirect occurs on the same host but changes scheme (e.g., HTTPS to HTTP) or port. This happens because the library reissues requests with credentials after comparing only the hostname, exposing sensitive headers in cleartext or to unintended services.
CVE-2026-115700 is a Server Side Request Forgery (SSRF) vulnerability in the benoitc hackney library affecting versions from 4.0.1 up to but not including 4.9.0. The flaw arises from an interpretation conflict when handling percent-encoded bracketed IPv6 literals or IP literals with trailing dots, allowing bypass of allowlist checks and unintended connections to internal IP addresses. This issue was introduced as a fix attempt for a previous vulnerability (CVE-2026-47076) but still allows certain malformed IP literals to bypass validation. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9 and is fixed in version 4.9.0.
CVE-2026-112880 is an HTTP Request/Response Splitting vulnerability in the hackney HTTP client library. It occurs because the proxy_auth_fun callback's return value is written into the Proxy-Authorization header without sanitization, allowing injection of CR, LF, or NUL bytes. This can lead to additional header lines being added to requests sent to an HTTP CONNECT proxy. The issue affects hackney versions from 2.0.0 up to but not including 4.9.0 and was fixed in version 4.9.0.
CVE-2026-116283 is an information disclosure vulnerability in Kameleo versions 5.0.1.0 through 5.0.1.19. The flaw exists in the Local API component, specifically in the /profiles file, and can be exploited remotely. Upgrading to version 5.2.0 mitigates this issue.
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
Harbor versions prior to 2.15.3, 2.14.5, and 2.13.6 contain a Server-Side Request Forgery (SSRF) vulnerability in the webhook delivery component. An authenticated attacker with ProjectAdmin permissions can configure webhooks to target internal private or link-local IP addresses. When triggered, Harbor's jobservice makes unauthenticated HTTP POST requests to these targets. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata.
CVE-2026-108529 is an inefficient algorithmic complexity vulnerability in the HTTP/2 implementation of the mtrudel bandit server. An unauthenticated remote attacker can exhaust the server CPU by sending many small SETTINGS or connection-level WINDOW_UPDATE frames, causing the server to perform costly O(n²) operations when retrying blocked sends. This affects bandit versions from 0.3.4 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
A critical vulnerability (CVE-2026-59107) exists in the vSolution Matrix file sharing feature of WolfVision Cynap Pro and Cynap Core Pro devices configured as main/master stations. The flaw involves a shared cryptographic trust configuration that could allow an attacker with the matching private key to authenticate via SSH as root. This affects versions prior to 1.78a and version 0. A fix is available in version 1.78a.
CVE-2026-110499 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.6 up to but not including 1.14.0. It involves allocation of resources without limits or throttling, where an unauthenticated remote attacker can cause unbounded growth in per-connection memory and CPU usage by specifying a large SETTINGS_HEADER_TABLE_SIZE. This leads to quadratic CPU cost per connection due to the HPACK encoder table resizing and linear scanning of response headers. The issue is fixed in version 1.14.0.
This content is a thematic cybersecurity analysis using Christopher Nolan's film adaptation of The Odyssey as an allegory to illustrate various cybersecurity concepts and threats. It draws parallels between characters and events in the story and common cyber threats such as ransomware, Trojan horses, VPN usage, social engineering, DDoS attacks, and advanced persistent threats (APTs). The narrative uses metaphorical language to educate about digital hygiene and security principles rather than describing an actual technical vulnerability or active threat.
CVE-2026-109584 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit that allows unauthenticated remote attackers to exhaust server memory. The flaw arises from improper handling of highly compressed HPACK HEADERS blocks, where a small compressed block can cause excessive memory allocation by repeatedly referencing a large cookie value. This affects bandit versions from 0.3.3 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-111103 is an improper cleanup on thrown exception vulnerability in the HTTP/2 handler of the mtrudel bandit server. It allows unauthenticated remote attackers to bypass per-connection resource limits by sending a single TCP write containing multiple frames, one of which triggers a stream error. This causes the server to roll back certain connection state variables, effectively ignoring some streams and allowing more concurrent streams than intended. The issue affects bandit versions from 1.9.0 up to but not including 1.14.0.
CVE-2026-111101 is a high-severity vulnerability in mtrudel bandit's HTTP/1.1 chunked body reader. It allows unauthenticated remote attackers to exhaust server memory and CPU by sending requests with many small 1-byte chunks. The vulnerability arises because the chunked reader accumulates each chunk without limits, causing excessive memory and CPU usage. This affects bandit versions from 0.1.0 up to but not including 1.14.0. A fix is available in version 1.14.0.
CVE-2026-113436 is an inefficient algorithmic complexity vulnerability in the header integer parser of the mtrudel bandit HTTP server. An unauthenticated remote attacker can exploit this by sending extremely large numeric values in headers such as content-length or Host, causing excessive CPU consumption. This affects versions from 1.0.0-pre.7 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-110314 is a vulnerability in the mtrudel bandit WebSocket connection handling where client-side enforcement incorrectly allows continued execution of WebSocket handler code after the server has sent a Close frame. This flaw enables a remote client to send data frames that are processed despite the server intending to close the connection, potentially allowing unauthorized actions such as admin-only operations. The issue affects bandit versions from 0.5.1 up to but not including 1.14.0 and is fixed in version 1.14.0.
CVE-2026-114213 is a high-severity resource exhaustion vulnerability in mtrudel bandit's WebSocket fragment reassembly. An unauthenticated remote attacker can send many 1-byte fragmented continuation frames to exhaust server memory. The vulnerability arises because the server keeps each non-final continuation frame as a separate list cell without limiting the number of fragments, causing disproportionate memory use. This affects bandit versions from 1.11.0 up to but not including 1.14.0. The issue is fixed in version 1.14.0.
CVE-2026-114216 is an HTTP Request/Response Smuggling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit. It allows an unauthenticated remote attacker to smuggle a second HTTP request past a front-end proxy by exploiting how chunk extensions with bare LF characters are handled. This affects bandit versions from 1.12.4 up to but not including 1.14.0. The issue arises because the chunked reader improperly parses chunk-size lines, allowing control characters that some proxies interpret differently, leading to request smuggling. Deployments without a proxy in front of bandit are not affected. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity). A fix is available in version 1.14.0.
CVE-2026-115269 is a high-severity vulnerability in mtrudel bandit's HTTP/2 request body reader that allows an unauthenticated remote attacker to cause an infinite loop by sending WINDOW_UPDATE or empty SETTINGS frames. This keeps stream processes open indefinitely, potentially exhausting resources. The issue affects bandit versions from 1.4.0 up to but not including 1.14.0. A fix is available in version 1.14.0.
The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution on PHP servers. After PHP released patches on October 21, 2026, attackers successfully exploited these flaws against honeypots on October 24, launching 35 shells from two IP addresses. The exploitation involved a four-stage HTTP request chain causing memory exhaustion, memory leaks, and ultimately shell command execution. This confirms real-world remote code execution beyond prior crash-only observations. The exploit closely matches a public proof-of-concept and bypasses ASLR protections. While confirmed on a specific PHP configuration, broader exploit reliability remains unmeasured. As of October 26, CISA had not observed confirmed exploitation in the wild or added these vulnerabilities to its KEV catalog.
CVE-2026-108525 is a high-severity vulnerability in the HTTP/2 implementation of mtrudel bandit versions from 0.3.1 up to but not including 1.14.0. It allows an unauthenticated remote attacker to exhaust server memory by sending DATA frames beyond the advertised receive window and withholding WINDOW_UPDATE frames. This causes the stream process to block and queue frames until the server's BEAM node runs out of memory, leading to a denial of service.