A BSON symbol namespace bypasses MongoDB's authorization check (CVE-2026-18690)

CVE-2026-25089: FortiSandbox unauthenticated command injection added to CISA KEV

Ivanti Sentry pre-auth RCE (CVE-2026-10520) – CVSS 10.0, public PoC, CISA KEV