Latest CVE news

Two Chrome Mojo sandbox escapes (CVSS 9.6 and 8.3), a chainable Unraid NAS auth bypass + root RCE, and an AnythingLLM SQL injection lead 87 notable CVEs from March 16. One Unraid flaw targets the same file patched in 2020.

Five critical vulnerabilities lead the March 14-15 batch of 215 new CVEs. A CVSS 9.8 unauthenticated WordPress RCE, OneUptime's fourth CVSS 9.9 in six weeks, and three unpatched D-Link buffer overflows top the list.

Six critical RustDesk Client vulnerabilities (CVSS 9.1–9.3) affect all platforms. Nginx UI CVE-2026-27944 (CVSS 9.8) leaks full server backups without authentication. No RustDesk patch yet.