Latest Vulnerability news

Four CVSS 9.9 flaws hit Veeam Backup and Replication, letting domain users run code on backup servers. The March 13 vulnerability digest covers eight Veeam patches, a Tolgee XXE, and a TP-Link command injection.

Two actively exploited Chrome zero-days in the Skia graphics engine and V8 JavaScript engine prompted an emergency Google patch within 48 hours. These are the second and third Chrome zero-days of 2026. Update to 146.0.7680.75 now.

Two CVSS 10.0 flaws top the March 12 CVE digest, with Himmelblau's Azure Entra ID bypass letting attackers authenticate to any tenant and a Jellyfin GitHub Actions flaw enabling full repo takeover. 644 new CVEs in one day.

420 new CVEs dropped on March 11, with three scoring critical. A WordPress LMS auth bypass (CVSS 9.8) threatens 30,000 sites, a gas station system has unauthenticated RCE, and Fortinet disclosed 11 flaws including an MFA bypass.

A nother ingress-nginx annotation injection (CVSS 8.8) continues a year-long chain of Kubernetes controller flaws that started with IngressNightmare. Seven Unisoc NR modem bugs can crash Android phones remotely. Budibase leaks shell commands through its PostgreSQL integration.

March 9 brought 117 new CVEs but no critical-severity entries. The two worth tracking are an unpatched UltraVNC DLL hijack with a public exploit, and two Tiandy surveillance flaws from a vendor that has ignored disclosures since 2017.

Over 221 CVEs dropped in two days — headlined by a CVSS 9.9 RCE in Tencent's WeKnora LLM framework, a Parse Server authentication bypass at 9.3, and a WooCommerce CSRF that put 4.5 million online stores at risk. Patches are …