07:34
2026-09-28
anas-security-portfolio.vercel.app
ai-agents
I found an SSRF in Google's official MCP Toolbox (CVE-2026-14540)
Google assigned CVE-2026-14540, a CVSS 8.0 server-side request forgery in its MCP Toolbox for Databases, where the HTTP client was initialized without a CheckRedirect policy or target IP validation, a…