Latest Vulnerability news

A certificate validation bypass in wolfSSL's OpenSSL compatibility layer lets anyone holding a free Let's Encrypt cert forge a TLS chain for any domain. CVE-2026-5501 (CVSS 4.0 score 8.6) affects nginx and haproxy builds linked against wolfSSL. Patched in 5.9.1, …

A single false parameter passed to .NET's Response.Redirect() kept the admin panel rendering after a redirect. watchTowr chained it to RCE on 30,000 internet-facing ShareFile servers. Patched March 10, disclosed April 2.

88 new CVEs on March 31 include a CVSS 10.0 NocoBase sandbox escape to root RCE, a WordPress Everest Forms Pro RCE, five baserCMS command injections, and SQL injections in Umami and SciTokens. Eleven vulnerabilities scored 9.0 or above.

A CVSS 10.0 sandbox escape in NocoBase's Workflow JavaScript node lets authenticated users reach root RCE through three lines of code. The console object leaks a host-realm Function constructor via prototype chain traversal. Patched in v2.0.28.

A denial-of-service bug patched five months ago turned out to be unauthenticated RCE with CVSS 9.8. F5 confirmed nation-state exploitation of CVE-2025-53521 in BIG-IP APM, and CISA gave federal agencies three days to patch. 240,000+ instances are exposed.

A zero-click XSS in Excel lets attackers instruct Copilot Agent to exfiltrate document contents to external servers. Microsoft patched CVE-2026-26144 on March 10, rating it Critical despite a CVSS 7.5 score.

Four CVSS 9.9 flaws hit Veeam Backup and Replication, letting domain users run code on backup servers. The March 13 vulnerability digest covers eight Veeam patches, a Tolgee XXE, and a TP-Link command injection.

Two actively exploited Chrome zero-days in the Skia graphics engine and V8 JavaScript engine prompted an emergency Google patch within 48 hours. These are the second and third Chrome zero-days of 2026. Update to 146.0.7680.75 now.

Two CVSS 10.0 flaws top the March 12 CVE digest, with Himmelblau's Azure Entra ID bypass letting attackers authenticate to any tenant and a Jellyfin GitHub Actions flaw enabling full repo takeover. 644 new CVEs in one day.

420 new CVEs dropped on March 11, with three scoring critical. A WordPress LMS auth bypass (CVSS 9.8) threatens 30,000 sites, a gas station system has unauthenticated RCE, and Fortinet disclosed 11 flaws including an MFA bypass.

A nother ingress-nginx annotation injection (CVSS 8.8) continues a year-long chain of Kubernetes controller flaws that started with IngressNightmare. Seven Unisoc NR modem bugs can crash Android phones remotely. Budibase leaks shell commands through its PostgreSQL integration.

March 9 brought 117 new CVEs but no critical-severity entries. The two worth tracking are an unpatched UltraVNC DLL hijack with a public exploit, and two Tiandy surveillance flaws from a vendor that has ignored disclosures since 2017.

Over 221 CVEs dropped in two days — headlined by a CVSS 9.9 RCE in Tencent's WeKnora LLM framework, a Parse Server authentication bypass at 9.3, and a WooCommerce CSRF that put 4.5 million online stores at risk. Patches are …

Six critical RustDesk Client vulnerabilities (CVSS 9.1–9.3) affect all platforms. Nginx UI CVE-2026-27944 (CVSS 9.8) leaks full server backups without authentication. No RustDesk patch yet.