Week 11, 2026

9 March to 15 March 2026. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.

CVEs published: 1,396
Critical: 125
High: 566
Added to KEV: 6

Critical 125High 566Medium 652Low 49Not scored 4All 1,396 in the list

Added to KEVAttackers use these now; patch them first

CVE-2026-3910
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…
Google · Chrome
ExploitedHigh8.8
CVE-2026-3909
Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.8
CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
n8n-io · n8n
ExploitedCritical10.0
CVE-2025-26399
SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
SolarWinds · Web Help Desk
ExploitedCritical9.8
CVE-2026-1603
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.
Ivanti · Endpoint Manager
ExploitedHigh8.6
CVE-2021-22054
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an…
VMware Workspace ONE UEM console
ExploitedHigh7.5

Most severe new CVEsBy CVSS score

CVE-2026-3611
Honeywell IQ4x BMS Controller Missing authentication for critical function
Honeywell · IQ4E
Critical10.0
CVE-2026-21669
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Veeam · Backup and Replication
Critical10.0
CVE-2026-30957
OneUptime Synthetic Monitor RCE via exposed Playwright browser object
OneUptime · oneuptime
Critical10.0
CVE-2026-21666
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Veeam · Backup and Replication
Critical10.0
CVE-2026-21667
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
Veeam · Backup and Replication
Critical10.0
CVE-2026-27591
Winter: Privilege escalation by authenticated backend users
wintercms · winter
Critical10.0
CVE-2026-27897
Vociferous Unauthenticated Remote Path Traversal (RCE via CSRF)
WanderingAstronomer · Vociferous
Critical10.0
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
OneUptime · oneuptime
Critical10.0
CVE-2026-31957
Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments
himmelblau-idm · himmelblau
Critical10.0
CVE-2026-26954
SandboxJS has a Sandbox Escape
nyariv · SandboxJS
Critical10.0

Week 11, 2026

Added to KEVAttackers use these now; patch them first

Most severe new CVEsBy CVSS score

Vendors with the most CVEs

Most common weaknesses