Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
HashiCorp, Veeam, and the Django Software Foundation have released patches for 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and…
Tag: Cross-Tenant
CVE-2026-2473: Google Vertex AI Experiments Bucket Squatting Vulnerability
A separate bucket-squatting vulnerability in Google Vertex AI Experiments that allowed cross-tenant code execution, model theft, and poisoning. Patched by Google in…
CVE-2026-41947: Authorization Bypass in Dify Trace Configurations
A critical authorization bypass vulnerability (CVSS 9.1) in Dify that allows authenticated editor users to set and enable trace configurations for any…
CVE-2026-41949: Authorization Bypass in Dify File Preview Endpoint
An authorization bypass vulnerability (CVSS 7.5/5.9) in Dify's file preview endpoint that allows any authenticated user to read up to 3,000 characters…