30
47
60
47
42
30
60
55
30
55
55
30
60
30
30
Microsoft December 2020 Patch Tuesday fixes 58 bugs, 9 are critical
60
Microsoft Releases Patches For Critical Windows TCP/IP and Other Bugs
60
30
55
June 2020 Patch Tuesday: Microsoft fixes record monthly number of CVEs
60
42
60
60
60
60
42
KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)
Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.
CVE-2026-66066 (KindaRails2Shell), discovered by Ethiack researchers and independently by RyotaK of GMO Flatt Security, lets attackers upload crafted files that exploit libvips' handling of specialty formats to read arbitrary files, including process environment secrets, potentially escalating to RCE. Default Rails 7.0+ setups using Active Storage with the vips processor are affected before versions 7.2.3.2, 8.0.5.1, and 8.1.3.1; fixes shipped July 29, 2026, with VIPS_BLOCK_UNTRUSTED as a partial mitigation. Proof-of-concept exploits circulated after disclosure, and VulnCheck updated that it observed active exploitation originating from a single French IP establishing C2 to a host in Israel. Akamai deployed WAF rules, but experts stress patching and credential rotation over filtering alone.
82
60
Microsoft Patch Tuesday — February 2019 Update Fixes 77 Flaws
60
Microsoft September 2020 Patch Tuesday addresses 129 flaws
60
60
60
30
60
Microsoft February 2021 Patch Tuesday fixes 56 bugs, including an actively exploited Windows zero
60
Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)
Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.
Microsoft patched CVE-2026-69836, a critical (maximum CVSS 10.0) unauthenticated remote code execution flaw in Entra ID caused by deserialization of untrusted data over a network. Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service verifying logins and controlling access to Microsoft 365, Azure, and connected third-party apps. The flaw was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and fully mitigated server-side, requiring no customer action. Microsoft initially reported the bug as exploited, but later changed the status to 'no' and confirmed the vulnerability was not exploited in the wild.
72
Microsoft March 2022 Patch Tuesday updates fix 89 vulnerabilities
60
60
30
Microsoft Patch Tuesday for January 2021 fixes 83 flaws, including an actively exploited issue
60