Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-1207 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 | 5.4 | 13% | ||
| CVE-2026-14869 | The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an… | 8.6 | <1% | ||
CVE-2026-15307+3 related CVEs | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8 | 8.7 group max | <1% | ||
| CVE-2026-16496 | The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who… | 8.9 | <1% | ||
| CVE-2026-16498 | The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may… | 10.0 | <1% | ||
| CVE-2026-32998 | This vulnerability in Veeam Service Provider Console allows for remote code execution | 9.4 | <1% | ||
| CVE-2026-58067 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service | 8.7 | <1% | ||
| CVE-2026-58071 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a… | 8.2 | <1% | ||
| CVE-2026-58072 | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution | 9.0 | <1% | ||
| CVE-2026-58073 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials | 9.5 | <1% |
From the original article
6 min read at thehackernews.com
HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9. 5 A cross-tenant flaw in HashiCorp's MCP server that lets one user's Terraform token be reused for later users' requests, scored a maximum 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.