CVE-2026-93328: MCP Toolbox for Databases (googleapis/mcp-toolbox)
- Severity
- 9.3 (CRITICAL)
- Vendor
- GOOGLE CLOUD
- Affected versions
- 1.2.0 through before 1.5.0
- Patch status
- Unknown
- Published
- 2026-10-26T15:16:45.813
Why it matters
This critical vulnerability allows unauthenticated remote attackers to exfiltrate sensitive host files and overwrite arbitrary local files within the Google Cloud MCP Toolbox for Databases. This could lead to severe data breaches, system compromise, or denial of service, impacting database managemen
Recommended admin actions
- Identify all instances of Google Cloud MCP Toolbox for Databases in your environment.
- Verify if installed versions fall within the affected range of 1.2.0 through 1.4.0.
- Monitor system logs for any unusual file access patterns or data exfiltration attempts.
- Review vendor advisories and official channels for a security patch or recommended workarounds.
- Implement network segmentation or access restrictions to limit exposure of affected systems.
Technical summary
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
View the official NVD record for CVE-2026-93328
AI-enriched (HIGH confidence). Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
640 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-65145 |
NVIDIA NeMo Agent Toolkit
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-105781 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-104351 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-104353 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105489 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105780 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-18450 |
X12SPI
Reporter: DEF9A96E-E099-41A9-BFAC-30FD4F82C411
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-92885 |
Qode Membership
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76934 |
JP1/Automatic Job Management System 3 – Manager: from 11-00 PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76938 |
JP1/Automatic Job Management System 3 – Manager: from 10-00 PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76939 |
JP1/Automatic Job Management System 3 – Manager: from 11-00 PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-82116 |
HiRDB Server PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-82117 |
HiRDB Server PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-82118 |
HiRDB Server PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-82119 |
HiRDB Server PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-82120 |
HiRDB Server PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-86574 |
JP1/Base: from 11-00 PATCH
Reporter: HIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-116692 |
mlflow PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110879 |
jackson-databind PATCH
Reporter: 36C7BE3B-2937-45DF-85EA-CA7133EA542C
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-106013 |
Jupiter X Core
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-84999 |
Pie Register Premium
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-116863 |
Newsletters
Reporter: AUDIT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-48360 |
ADOBE
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-103594 |
Fireware OS
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
9.5
CRITICAL
|
VIEW RECORD |
| CVE-2026-76932 |
JP1/Automatic Job Management System 3 – Manager: from 11-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-76933 |
JP1/Automatic Job Management System 3 – Manager: from 11-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-76935 |
JP1/Automatic Job Management System 3 – Manager: from 10-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-76936 |
JP1/Automatic Job Management System 3 – Manager: from 10-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-76937 |
JP1/Automatic Job Management System 3 – Manager: from 10-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-82122 |
HiRDB Server PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-86575 |
JP1/Integrated Management 3 – Manager: from 13-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-86576 |
JP1/Integrated Management 3 – Manager: from 13-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-86577 |
JP1/Integrated Management 3 – Manager: from 13-00 PATCH
Reporter: HIRT
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-90465 |
Fireware OS
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-102788 |
Gridbox extension for Joomla
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102789 |
Gridbox extension for Joomla
Reporter: SECURITY
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-117532 |
REDAXO core from 5.3.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-117564 |
nest-admin PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-117601 |
Electrum PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-117603 |
Electrum PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-104350 |
ADOBE
Reporter: PSIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114595 |
DHS
Reporter: ICS-CERT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112709 |
Fireware OS
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-112710 |
Fireware OS
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-93857 |
Fireware OS
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-93865 |
Fireware OS
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-93866 |
Fireware OS
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-118375 |
llama.cpp
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-112362 |
@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In PATCH
Reporter: CE714D77-ADD3-4F53-AFF5-83D477B104BB
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-115216 |
Keycloak PATCH
Reporter: EMO
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-104354 |
ADOBE
Reporter: PSIRT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-105779 |
ADOBE
Reporter: PSIRT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108014 |
HCL
Reporter: PSIRT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108015 |
HCL
Reporter: PSIRT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-108142 |
Backup and Replication
Reporter: SUPPORT
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-112352 |
Sunhillo SureLine PATCH
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-58256 |
GRR PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-106076 |
Backup for Microsoft 365
Reporter: SUPPORT
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-75891 |
Kirki – Freeform Page Builder, Website Builder & Customizer
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-65220 |
MBD-X12SPI
Reporter: DEF9A96E-E099-41A9-BFAC-30FD4F82C411
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-4337 |
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application
Reporter: CVE-COORDINATION
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-118008 |
MOZILLA PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-107672 |
AUTODESK
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111585 |
TEAMVIEWER PATCH
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-92372 |
TEAMVIEWER PATCH
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114596 |
DHS
Reporter: ICS-CERT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116672 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108303 |
Certificate Manager
Reporter: 3938794E-25F5-4123-A1BA-5CBD7F104512
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108329 |
Threat Response
Reporter: 3938794E-25F5-4123-A1BA-5CBD7F104512
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116676 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-83831 |
Double free in Microsoft Edge (Chromium-based)
Reporter: SECURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-85898 |
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based)
Reporter: SECURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-58255 |
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116870 |
Product identification pending
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116871 |
Semantic MediaWiki 3.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116872 |
Semantic MediaWiki from 3.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116877 |
Semantic MediaWiki from 2.5.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116878 |
Semantic MediaWiki from 2.5.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-117540 |
svg-sanitizer from 0.5.3 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-102800 |
mod djhelpful articles/helper.php), reachable without authentication
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-106087 |
TRO600
Reporter: CYBERSECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-117604 |
Grav from 1.7.53.3 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111107 |
A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-93434 |
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114597 |
DHS
Reporter: ICS-CERT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114598 |
DHS
Reporter: ICS-CERT
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-102814 |
RE305 v3
Reporter: F23511DB-6C3E-4E32-A477-6AA17D310630
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112350 |
Sunhillo SureLine PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112351 |
Sunhillo SureLine PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112355 |
The MembershipWorks plugin for WordPress PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116693 |
dd-trace-js PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2014-125138 |
C97net qEngine CMS
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-118377 |
mews/pos
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-117466 |
Product identification pending
Reporter: SECURITY
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-117536 |
REDAXO PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-117602 |
Electrum 4.6.0 PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-90442 |
A stack-based buffer overflow vulnerability in the Fireware OS certd process
Reporter: 5D1C2695-1A31-4499-88AE-E847036FD7E3
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116682 |
FileBrowser Quantum is a free, self-hosted, web-based file manager PATCH
Reporter: SECURITY-ADVISORIES
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2013-20007 |
Linksys WAG200G
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2015-20129 |
CrushFTP PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.