CVSS 10.0 Cross‑Tenant Bug Hits Terraform MCP, Veeam Console, Django
HashiCorp fixed a CVSS 10.0 cross‑tenant token reuse flaw in Terraform MCP Server (CVE‑2026‑16498), while Veeam patched an unauthenticated credential‑theft bug in its Service Provider Console (CVSS 9.5) and Django released a critical SQL injection fix (CVE‑2026‑1207). Together they close 11 high‑severity issues affecting multi‑tenant cloud deployments.