Latest CVE digest March 2026 news

Four CVSS 9.9 flaws hit Veeam Backup and Replication, letting domain users run code on backup servers. The March 13 vulnerability digest covers eight Veeam patches, a Tolgee XXE, and a TP-Link command injection.

Two CVSS 10.0 flaws top the March 12 CVE digest, with Himmelblau's Azure Entra ID bypass letting attackers authenticate to any tenant and a Jellyfin GitHub Actions flaw enabling full repo takeover. 644 new CVEs in one day.