60
October 2018 Patch Tuesday: Microsoft fixes 49 flaws, one APT-wielded zero-day
60
Critical N-able N-central Vulnerability and Active Exploitation
N-able N-central pre-auth RCE zero-day CVE-2026-86218 (CVSS 10.0) is exploited in the wild; on-prem admins must upgrade to 2026.3 HF4.
N-able disclosed a third N-central vulnerability, CVE-2026-86218, a pre-authentication RCE rated CVSS 10.0, and released hotfix 2026.3 HF4 superseding build 2026.3.1.13. Huntress reproduced an exploit chain involving an authentication bypass (CVE-2026-86206/CVE-2026-86207) after a fully patched customer's N-central production server was compromised on September 4. Attackers appended strings like .invalid to account names and probed the /remoteControlAction.do?method=getPierDetails endpoint; Huntress worked with Cloudflare to disable adversary tunnel infrastructure. Hosted N-central instances are already patched; on-prem administrators must upgrade immediately.
83
December 2018 Patch Tuesday: Microsoft patches Windows zero-day exploited in the wild
60
60
60
60
60
September 2019 Patch Tuesday: Microsoft plugs two actively exploited zero-days
60
60
60
60
60
November 2018 Patch Tuesday: Microsoft fixes 63 flaws, one actively exploited zero-day
60
60
60
60
50
60
60
45
60
60
60
60
GitLab Warns of Active Exploitation of Critical GraphQL Flaw
GitLab emergency-patches actively exploited flaw CVE-2026-19478 (CVSS 9.4), letting unauthenticated attackers modify or delete public projects on self-managed servers.
GitLab emergency-patched CVE-2026-19478 (CVSS 9.4) on August 17 after WatchTowr researchers warned of active exploitation. The flaw lets unauthenticated attackers remotely modify or delete public projects and user data through a GraphQL directive, affecting only self-managed installations. Fixes ship in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11; the 18.2-18.10 branches receive no patch and must upgrade. Until patching, defenders should restrict unauthenticated access to /api/graphql, disable public repositories, and hunt for @gl_introduced in logs.
78
August 2018 Patch Tuesday: Microsoft fixes two actively exploited zero-days
60
Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout
60
60
60
60
60
60
60
60
60
60
June 2021 Patch Tuesday: Microsoft fixes six actively exploited zero-days
60
57
60