August 6, 2026
- Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920), with a full write-up of the injection (syntetisk.tech). · Vulnerabilities & Exploits
- Others worth noting: a CVSS 10.0 cross-tenant flaw in HashiCorp's Terraform MCP Server (one user's token reusable by later users) plus a CVSS 9.5 unauthenticated Veeam Service Provider Console bug, among 11 patched (The Hacker News); and an unfixed path-traversal in Apache Dubbo 3.0.0–3.3.6 (SecureLayer7). · Vulnerabilities & Exploits
in OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board