{"vulnerability": "cve-2026-1649", "sightings": [{"uuid": "b6d52545-29a3-4111-b13a-cc30c1c53550", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msb6zqym2e2u", "content": "Terraform MCP Server Flaw CVE-2026-16498 Scores CVSS 10.0", "creation_timestamp": "2026-08-04T14:12:43.971206Z"}, {"uuid": "ea88b6a8-59e2-4b65-9ed5-4924896e6270", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-05T15:00:06.267801Z"}, {"uuid": "42f2c436-9cbb-4af2-b4b8-b8805f49f536", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16496", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-05T15:00:06.313077Z"}, {"uuid": "abb53906-d557-473b-bae2-65883924b90a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-06T00:00:33.745855Z"}, {"uuid": "54dd35c3-9527-4677-b451-4a0b1a57f1f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16496", "type": "seen", "source": "https://t.me/thehackernews/9717", "content": "\ud83d\udea8 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes.\n\nVeeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE.\n\nHashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869.\n\nDjango fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution.\n\nSee what needs patching:  https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html", "creation_timestamp": "2026-08-06T00:00:33.786350Z"}, {"uuid": "3fbc0e80-8ab8-41d8-aa83-2c5353d3555e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16493", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr6idabn5l2s", "content": "CVE-2026-16493 - Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)\nCVE ID : CVE-2026-16493\n \n Published : July 21, 2026, 5:26 p.m. | 18\u00a0minutes ago\n \n Description : A flaw was found in ansible-core. The _ext...", "creation_timestamp": "2026-07-21T18:55:52.510049Z"}, {"uuid": "f8d40402-bd98-43e0-aa2d-22b0ee95ed44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16492", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr7ehohfv32e", "content": "CVE-2026-16492 - umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection\nCVE ID : CVE-2026-16492\n \n Published : July 22, 2026, 1:16 a.m. | 28\u00a0minutes ago\n \n Description : A weakness has been identified in umijs umi up to 4.6.63. The affected eleme...", "creation_timestamp": "2026-07-22T03:19:29.236257Z"}, {"uuid": "5ef300cd-b1a1-4327-84fe-330bf405b4bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16490", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr7eqncpgw2i", "content": "CVE-2026-16490 - itsourcecode Hospital Management System prescription.php sql injection\nCVE ID : CVE-2026-16490\n \n Published : July 22, 2026, 1:16 a.m. | 28\u00a0minutes ago\n \n Description : A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacte...", "creation_timestamp": "2026-07-22T03:24:27.095223Z"}, {"uuid": "2cc554a0-bc95-4900-98ed-2f7295dbd318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-16498", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq4tetkat23", "content": "CVE-2026-16498 - tooling\nThe Terraform MCP Server before version 1.1.0 allows one user's credentials to be used by other users. This means that if one user's credentials are compromised, an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#tooling #hashicorp #CVE #infosec", "creation_timestamp": "2026-07-28T19:18:04.340622Z"}]}