Microsoft March 2026 Security Updates

Microsoft March 2026 Early Security Updates

Microsoft February 2026 Security Updates

Microsoft January 2026 Security Updates

Microsoft December 2025 Security Updates

Microsoft December 2025 Early Security Updates

Microsoft November 2025 Security Updates

Microsoft October 2025 Security Updates

Microsoft September 2025 Security Updates

Microsoft August 2025 Security Updates

Microsoft August Early 2025 Security Updates

Microsoft July 2025 Security Updates

Microsoft June 2025 Security Updates

Microsoft June Early 2025 Security Updates

Microsoft May 2025 Security Updates

Microsoft May Early 2025 Security Updates

Microsoft April 2025 Security Updates

Microsoft March 2025 Security Updates

Microsoft March 2025 Early Security Updates

Microsoft February 2025 Security Updates

Microsoft February 2025 Early Security Updates

Microsoft January 2025 Security Updates

Microsoft January 2025 Early Security Updates

Microsoft December 2024 Security Updates

Microsoft November 2024 Security Updates

Microsoft October 2024 Security Updates

Microsoft September 2024 Security Updates

Microsoft August 2024 Security Updates

Microsoft July 2024 Security Updates

Microsoft June 2024 Security Updates

Microsoft May 2024 Security Updates

Microsoft April 2024 Security Updates

Microsoft March 2024 Security Updates

Microsoft February 2024 Security Updates

Microsoft January 2024 Security Updates

simple-git

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Improper Handling of Case Sensitivity

Any application that passes user-controlled values into the customArgs
parameter of clone(), fetch(), pull(), push() or similar simple-git
methods is vulnerable to arbitrary command execution on the host machine. The ext:: git protocol executes an arbitrary binary as a remote helper.
With protocol.allow=always enabled, an attacker can run any OS command
as the process user — full read, write and execution access on the host.

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

steveukx

Command injection vulnerability in simple-git versions 3.15.0 through 3.32.2. Any application that passes user-controlled values into the customArgs parameter of clone(), fetch(), pull(), push() or similar simple-git methods is vulnerable to arbitrary command execution on the host machine. The ext:: git protocol executes an arbitrary binary as a remote helper. With protocol.allow=always enabled, an attacker can run any OS command as the process user with full read, write and execution access on the host.

Command Line Execution through SQL Injection

Command Delimiters

Exploiting Multiple Input Interpretation Layers

Argument Injection

OS Command Injection

Github Advisory

github.com

Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based Buffer Overflow

Out-of-bounds Write

A security flaw has been discovered in Tenda i12 1.0.0.6(2204). Impacted is the function vos_strcpy of the file /goform/exeCommand. The manipulation of the argument cmdinput results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Tenda

Buffer Overflow via Environment Variables

Overflow Buffers

Buffer Manipulation

Client-side Injection-induced Buffer Overflow

Filter Failure through Buffer Overflow

MIME Conversion

Overflow Binary Resource File

Buffer Overflow via Symbolic Links

Overflow Variables and Tags

Buffer Overflow via Parameter Expansion

Buffer Overflow in an API Call

Buffer Overflow in Local Command-Line Utilities

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

Backup and Recovery

Veeam

The CVE description is not yet available but Feedly AI found some discussions about it

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Pix for WooCommerce

linknacional

adguardhome

Improper Authentication

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.73, an unauthenticated remote attacker can bypass all authentication in AdGuardHome by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided. This vulnerability is fixed in 0.107.73.

AdguardHome

AdguardTeam

An unauthenticated remote attacker can bypass all authentication in AdGuard Home by sending an HTTP/1.1 request that requests an upgrade to HTTP/2 cleartext (h2c). Once the upgrade is accepted, the resulting HTTP/2 connection is handled by the inner mux, which has no authentication middleware attached. All subsequent HTTP/2 requests on that connection are processed as fully authenticated, regardless of whether any credentials were provided.

Authentication Abuse

Authentication Bypass

Identity Spoofing

Fake the Source of Data

Exploiting Trust in Client

Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

Session Hijacking

Token Impersonation

Upload a Web Shell to a Web Server

Adversary in the Middle (AiTM)

Abuse Elevation Control Mechanism

Application Access Token

Access Token Manipulation

Web Shell

Adversary-in-the-Middle

Improper Access Control

A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.

Backup and Replication

Embedding Scripts within Scripts

Malicious Logic Insertion

Modification of Windows Service Configuration

Malicious Root Certificate

Intent Spoof

WebView Exposure

Data Injected During Configuration

Incomplete Data Deletion in a Multi-Tenant Environment

Install New Service

Modify Existing Service

Install Rootkit 

Replace File Extension Handlers

Replace Trusted Executable

Modify Shared File

Add Malicious File to Shared Webroot

Run Software at Logon

Disable Security Software

Services Registry Permissions Weakness

Windows Service

Install Root Certificate

Systemd Service

Launch Daemon

Rootkit

Bootkit

Kernel Modules and Extensions

Change Default File Association

Accessibility Features

Taint Shared Content

Boot or Logon Initialization Scripts

Launch Agent

Boot or Logon Autostart Execution

Disable or Modify Tools

chrome

[Severity: High]
Out of bounds write in Skia. Reported by Google on 2026-03-10

Google Chrome update, version 146.0.7680.75 fixes the following vulnerabilities.

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Chrome

Google

Out of bounds write in Skia graphics library in Google Chrome. This vulnerability allows memory to be written outside of the intended bounds when the Skia rendering engine processes specially crafted content, potentially leading to arbitrary code execution.

Google Chrome chrome-146.0.7680.75

bugzilla.redhat.com

Improper Neutralization of Special Elements used in a Command ('Command Injection')

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.

GL-iNet GL-AR300M16 v4.3.11 contains a command injection vulnerability in the set_config function that allows attackers to execute arbitrary commands through crafted input.

Search CVEs by ID

Trending Vulnerabilities

Latest Patch Tuesday Reports

March 2026 Patch Tuesday: 10 Critical Vulnerabilities Amid 83 CVEs

March 2026 Early Security Update: 2 Critical Vulnerabilities Amid 5 CVEs

February 2026 Patch Tuesday: 10 Critical Vulnerabilities Amid 61 CVEs

Browse

Be the first to know about critical vulnerabilities