60
60
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
60
Google Pixel owners urged to patch actively exploited modem flaw
Google's September 2026 Pixel bulletin fixes 110 vulnerabilities, including CVE-2026-58704, a modem permission bypass under limited targeted exploitation enabling remote privilege escalation.
Google released the September 2026 Pixel Update Bulletin addressing 110 vulnerabilities, including CVE-2026-58704, a high-severity logic error in the cellular modem that allows remote escalation of privilege with no additional execution privileges or user interaction required. Google says there are indications the flaw may be under limited, targeted exploitation; attackers need adjacent network access and some existing foothold on the device, which the bulletin does not explain how to obtain. The fix ships at the 2026-09-05 patch level and appears only in the Pixel-specific bulletin, so other Android vendors do not receive this specific fix.
68
December 2019 Patch Tuesday: Microsoft fixes one actively exploited zero-day
60
March 2021 Patch Tuesday: Microsoft fixes yet another actively exploited IE zero-day
60
60
Chrome Zero-Day CVE-2025-6554 Under Active Attack — Google Issues Security Update
60
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update
60
Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild
60
Researcher Uncovers Critical Flaws in Multiple Versions of Ivanti Endpoint Manager
60
Week in review: Microsoft patches zero-day, Apple security updates, HashiCorp Vault vulnerability
60
4 New BlueKeep-like 'Wormable' Windows Remote Desktop Flaws Discovered
60
Microsoft fixes actively exploited Windows CLFS zero-day (CVE-2025-29824)
60
60
January 2021 Patch Tuesday: Microsoft plugs Defender zero-day RCE
60
60
60
ProxyLogon fixes for unsupported Microsoft Exchange versions released
60
60
Critical N-able N-central Vulnerability and Active Exploitation
N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.
N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.
83
Google fixes actively exploited Android zero-day on Pixel devices
Google patched 110 Pixel flaws including CVE-2026-58704, a modem privilege-escalation zero-day under limited targeted exploitation.
Google's September 2026 Pixel security update fixes 110 vulnerabilities, including CVE-2026-58704, a high-severity zero-day in the Cellular Modem subcomponent that Google says is under limited, targeted exploitation. The improper-authorization flaw lets attackers with adjacent network access and basic privileges escalate privileges without user interaction. The bulletin also includes 12 remote code execution and 89 privilege escalation flaws rated critical or high severity.
78
Microsoft plugs actively exploited zero-day hole (CVE-2023-21674)
60
Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.
CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.
72
60
60
60
60
February 2021 Patch Tuesday: Microsoft and Adobe fix exploited zero-days
60
Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
60
60
June 2021 Patch Tuesday: Microsoft fixes six actively exploited zero-days
60
Microsoft addresses three Windows issues actively exploited
60
60
60
Google fixes actively exploited Zero
60
63 New Flaws (Including 0
60
60
60
Google Warns of Pixel Firmware Security Flaw Exploited as Zero
60