Over the past 24 hours, Previdian’s honeypot network has captured exploitation attempts targeting four recently disclosed vulnerabilities: 1. MLflow (CVE-2026-116690): Arbitrary file read through prompt model versions, which can expose sensitive files accessible to the MLflow server process. 2. Google Brotli (CVE-2026-111497): A decoder buffer overflow triggered by crafted compressed data, potentially allowing memory disclosure, denial of service or remote code execution. 3. Oracle E-Business Suite (CVE-2026-101767): Unauthenticated SQL injection in Application Object Library that can be chained to remote code execution. 4. Laravel (CVE-2026-114509): A TokenGuard authentication bypass that can enable account takeover under affected MySQL/MariaDB configurations. The attempts targeted our real application honeypots for MLflow, Brotli and Laravel, and our Oracle E-Business Suite decoy. All four have been added to Previdian’s Known Exploited Vulnerabilities (KEV) catalog, with supporting evidence and technical details. If these products are in your environment, review the affected versions and prioritize the relevant vendor fixes. Explore the evidence: http://previdian.com
