Serial number: AV26-768
Date: July 31, 2026

As of July 30, 2026, Google is affected by vulnerabilities in the following product:

• Chrome - Prior to 151.0.7922.72

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Google Chrome Security Advisory

Serial Number: AV26-767
Date: July 31, 2026

As of July 30, 2026, Rails is affected by a vulnerability in the following product:

• Rails
  • Prior to 8.0.5.1
  • Prior to 8.1.3.1
  • Prior to 7.2.3.2

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release 7.2.3.2 · rails/rails - GitHub
• Release 8.0.5.1 · rails/rails - GitHub
• Release 8.1.3.1 · rails/rails - GitHub
• [CVE-2026-66066] Possible arbitrary file read and remote code execution in Active Storage variant processing
• Release list - rails/rails

Serial number: AV26-766
Date: July 30, 2026

As of July 30, 2026, SolarWinds is affected by a vulnerability in the following product:

• Web Help Desk (WHD)
  • Prior to 2026.2.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• WHD 2026.2.1 release notes
• SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability (CVE-2026-28323)
• SolarWinds Security Vulnerabilities

Serial number: AV26-765
Date: July 30, 2026

As of July 30, 2026, Gladinet is affected by vulnerabilities in the following product:

• CentreStack
  • Prior to 17.5

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• CentreStack

Serial number: AV26-764
Date: July 30, 2026

As of July 30, 2026, PHP Group is affected by vulnerabilities in the following product:

• PHP
  • Prior to 8.2.33
  • Prior to 8.3.33
  • Prior to 8.4.24
  • Prior to 8.5.9

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• SQL injection in ext-pgsql via E'...' backslash breakout
• Out-of-bounds write in bccomp() via crafted operand and scale

Serial number: AV26-763
Date: July 30, 2026

As of July 30, 2026, VMware is affected by vulnerabilities in the following products:

• Cloud Foundation
  • 5.x
  • 9.0.x.x
  • 9.1.x.x
  • Prior to 5.2.3
• ESX
  • Prior to ESXi-9.0.2.0100-25595025
  • Prior to ESXi-9.1.0.0-25370933
  • Prior to ESXi-9.1.0.0200-25557999
  • Prior to ESXi80U3i-25205845
  • Prior to ESXi80U3k-25595708
• Fusion
  • Prior to 26H1
• Telco Cloud Infrastructure
  • 3.0
• Telco Cloud Platform
  • 4.x
  • 5.0.x
  • 5.1.x
• Workstation
  • Prior to 26H1
• vCenter
  • Prior to 8.0 U3k
  • Prior to 9.0.2.0100
  • Prior to 9.1.0.0300
• vSphere Foundation
  • 9.0.x.x
  • 9.1.x.x

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)
• Security Advisories - VMware Cloud Foundation

Serial number: AV26-762
Date: July 30, 2026

As of July 30, 2026, Phoenix Contact is affected by vulnerabilities in the following products:

• CHARX SEC-3000
  • Prior to 1.9.1
• CHARX SEC-3050
  • Prior to 1.9.1
• CHARX SEC-3100
  • Prior to 1.9.1
• CHARX SEC-3150
  • Prior to 1.9.1

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Phoenix Contact: Multiple vulnerabilities in the firmware of CHARX SEC3xxx charging controllers

Serial number: AV26-761
Date: July 30, 2026

As of July 30, 2026, WebPros is affected by a vulnerability in the following product:

• Plesk
  • Prior to 18.0.79.4

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Vulnerability CVE-2026-58046: Blind SQL injection in Plesk's XML-RPC API – Plesk

Serial number: AV26-760
Date: July 30, 2026

As of July 29, 2026, Adobe is affected by vulnerabilities in the following product:

• Adobe Campaign Classic
  • ALL except 7.4.3 build 9398
  • Prior to or equal to 7.4.3 build 9397

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security update available for Adobe Campaign Classic | APSB26-114
• Adobe Product Security Incident Response Team

Serial number: AV26-759
Date: July 30, 2026

As of July 30, 2026, Spring is affected by vulnerabilities in the following products:

• Spring Tools for Eclipse
  • Prior to or equal to 5.2.0
• Spring Tools for VSCode / Cursor / Theia
  • Prior to or equal to 2.2.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-47858: live information startup mode is vulnerable for remote code execution
• CVE-2026-47873: Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
• CVE-2026-47882: Spring Boot DevTools remote secret generated with a non-cryptographic PRNG
• CVE-2026-59326: HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server
• CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
• CVE-2026-59328: Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
• Spring | Security Advisories

Serial number: AV26-758
Date: July 30, 2026

As of July 29, 2026, GitLab is affected by vulnerabilities in the following product:

• GitLab
  • Prior to 19.0.5
  • Prior to 19.1.3
  • Prior to 19.2.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5
• GitLab release notes

Serial number: AV26-757
Date: July 29, 2026

As of July 29, 2026, Cisco is affected by a vulnerability in the following product:

• Cisco Secure Firewall Management Center (FMC)
  • Prior to 7.0.9.1
  • Prior to 7.2.11.1
  • Prior to 7.4.7.1
  • Prior to 7.6.5.1
  • Prior to 7.7.12.1
  • Prior to 10.0.1.1

Cisco has indicated that CVE-2026-20316 is being exploited.

On July 29, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20316 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Cisco Security Advisories
• Cisco Secure Firewall Management Center Software Static Credential Vulnerability
• CISA KEV : CVE-2026-20316

Serial Number: AV26-756
Date: July 29, 2026

As of July 28, 2026, Adobe is affected by vulnerabilities in the following products:

• Adobe Bridge
  • Prior to 15.1.7
  • Prior to 16.0.6
• Format Plugins
  • Prior to 2026.07

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security updates available for Adobe Format Plugins | APSB26-87
• Security Updates Available for Adobe Bridge | APSB26-89
• Adobe Product Security Incident Response Team

Serial Number: AV26-755
Date: July 28, 2026

As of July 27, 2026, Progress Software is affected by vulnerabilities in the following products:

• ECS Connection Manager
  • Prior to 7.2.63.3
• LoadMaster
  • Prior to 7.2.54.19
  • Prior to 7.2.63.3
• MOVEit WAF
  • Prior to 7.2.63.3
• Multi Tenant
  • Prior to 7.1.35.16
• Object Scale Connection Manager
  • Prior to 7.2.63.3

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• LoadMaster Critical Security Bulletin – July 2026 – (CVE-2026-59686, CVE-2026-59687, CVE-2026-59688, CVE-2026-59689, CVE-2026-59690)

Serial Number: AV26-754
Date: July 28, 2026

As of July 27, 2026, Vercel is affected by vulnerabilities in the following product:

• next.js
  • Prior to 15.5.21
  • Prior to 16.2.11

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release v15.5.21
• Release v16.2.11

Serial Number: AV26-753
Date: July 28, 2026

As of July 27, 2026, Apple is affected by vulnerabilities in the following products:

• iOS and iPadOS
  • Prior to 26.6
• macOS
  • Prior to 14.8.8
  • Prior to 15.7.8
  • Prior to 26.6
• tvOS
  • Prior to 26.6
• visionOS
  • Prior to 26.6
• Safari
  • Prior to 26.6
• watchOS
  • Prior to 26.6

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Apple security releases - Apple Support

Serial Number: AV26-752
Date: July 28, 2026

As of July 27, 2026, JetBrains is affected by a vulnerability in the following product:

• TeamCity
  • Prior to 2026.1.3, 2025.11.7

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Fixed security issues
• Security - The JetBrains Blog

Serial Number: AV26-751
Date: July 28, 2026

As of July 27, 2026, Arista Networks is affected by vulnerabilities in the following product:

• VeloCloud Orchestrator On-Prem
  • from 5.2.0 to versions prior to 5.2.3.14
  • from 6.1.0 to versions prior to 6.1.3.4
  • from 6.4.0 to versions prior to 6.4.2.4
  • from 7.0.0 to versions prior to 7.0.0.1

On July 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-16812 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisory 0144
• Security Advisory 0145
• CISA KEV: CVE-2026-16812

Serial Number: AV26-749
Date: July 28, 2026

As of July 27, 2026, Apache is affected by vulnerabilities in the following product:

• Apache Thrift
  • Prior to 0.24.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-48586: Apache Thrift: TZlibTransport Decompression Size Limit
• CVE-2026-49158: Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
• CVE-2026-55969: Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
• CVE-2026-58023: Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

Serial Number: AV26-750
Date: July 27, 2026

As of July 27, 2026, Erlang is affected by vulnerabilities in the following product:

• OTP
  • 10.2 Prior to 11.7.4
  • 6.0 Prior to 17.0.4

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Security Advisories · erlang/otp · GitHub

Serial number: AV26-109
Date: February 10, 2026
Updated: July 27, 2026

On February 10, 2026, Fortinet published security advisories to address vulnerabilities in the following products:

• FortiAuthenticator 6.6 – versions 6.6.0 to 6.6.6
• FortiAuthenticator 6.5 – all versions
• FortiAuthenticator 6.4 – all versions
• FortiAuthenticator 6.3 – all versions
• FortiClientWindows 7.4 – versions 7.4.0 to 7.4.4
• FortiClientWindows 7.2 – versions 7.2.0 to 7.2.12
• FortiClientWindows 7.0 – all versions
• FortiOS 7.6 – versions 7.6.0 to 7.6.4
• FortiOS 7.4 – versions 7.4.0 to 7.4.10
• FortiOS 7.2 – all versions
• FortiOS 7.0 – all versions
• FortiOS 6.4 – all versions
• FortiSandbox 5.0 – version 5.0 to 5.1
• FortiSandbox 4.4 – version 4.4.0 to 4.4.7
• FortiSandbox 4.2 – all versions
• FortiSandbox 4.0 – all versions

Update 1

On July 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-68686 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Fortinet PSIRT Advisories
• CISA KEV: CVE-2025-68686

Serial number: AV26-748
Date: July 27, 2026

As of July 25, 2026, Redis is affected by a vulnerability in the following product:

• Redis
• Versions prior to 8.8.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Comparing 8.6.4...8.8.0
• Reject corrupt stream RDB with shared NACK across consumers #15081
• Releases · redis/redis · GitHub

Serial Number: AV26-747
Date: July 27 2026

Microsoft security advisory (AV26-747)

As of July 26, 2026, Microsoft is affected by vulnerabilities in the following product:

• Microsoft Edge (Chromium-based)
• Prior to 150.0.4078.99

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Update Guide - Microsoft Security Response Center
• Security Update Guide - Microsoft Security Response Center (1)
• Security Update Guide - Microsoft Security Response Center (2)
• Security Update Guide - Microsoft Security Response Center (3)

Serial number: AV26-746
Date: July 24, 2026

On July 23, 2026, Progress published security advisories to address vulnerabilities in the following product:

• MOVEit Transfer – versions prior to 2025.1.5
• MOVEit Transfer – versions prior to 2026.0.3

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• MOVEit Transfer 2026 Release Notes - Fixed Issues in 2026.0.3
• Progress Trust Center

Serial number: AV26-745
Date: July 24, 2026

On July 24, 2026, HPE published a security advisory to address vulnerabilities in the following product:

• HPE Unified Correlation Analyzer (UCA) – versions 4.4.11 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• HPESBNW05085 rev.1 - HPE Unified Correlation Analyzer (UCA), Multiple Vulnerabilities
• HPE Security Bulletin Library

Serial number: AV26-744
Date: July 24, 2026

On July 22, 2026, MongoDB published security advisories to address vulnerabilities in the following products:

• MongoDB Compass – versions prior to 1.49.7
• MongoDB Server – versions prior to 7.0.39
• MongoDB Server – versions prior to 8.0.28
• MongoDB Server – versions prior to 8.2.12
• MongoDB Server – versions prior to 8.3.7

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Security Related: Common Vulnerabilities and Exposures (CVEs)
• MongoDB Alerts

Serial number: AV26-743
Date: July 24, 2026

On July 24, 2026, Ericsson published a security advisory to address vulnerabilities in the following product:

• Packet Core Controller (PCC) – versions prior to 1.38
• Packet Core Controller (PCC) – versions prior to 1.39

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Security Bulletin – Ericsson Packet Core Controller (PCC), July 2026
• Ericsson Security Advisories

Serial number: AV26-742
Date: July 24, 2026

On July 24, 2026, Moxa published security advisories to address vulnerabilities in the following products:

• Moxa UC Series – multiple versions and models
• Moxa V Series – multiple versions and models
• Moxa VM-1220 Series – version MIL3 v1.1.0 and prior
• Moxa ioThinx 4530 Series – version MIL3 v2.1 and prior
• Moxa AIG Series – multiple versions and models
• Moxa BXP Series – multiple versions and models
• Moxa DRP-A100 Series / DRP-C100 Series – version Debian 11 V1.0
• Moxa RKP Series – multiple versions and models

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CVE-2026-46333: ssh-keysign-pwn Vulnerability in Linux Kernel
• Moxa Security Advisories

Serial number: AV26-741
Date: July 24, 2026

On July 23, 2026, Google published a security advisory to address vulnerabilities in the following product:

• Stable Channel Chrome for Desktop – versions prior to 150.0.7871.186/.187 (Windows/Mac), and 150.0.7871.186 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.

• Google Chrome Security Advisory

Serial number: AV26-740
Date: July 24, 2026

On July 23, 2026, Microsoft published a security update to address vulnerabilities in the following product:

• Microsoft Edge Stable Channel – versions prior to 150.0.4078.96

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.

• Microsoft Edge Stable Channel Release Notes

Serial number: AV26-739
Date: July 23, 2026

On July 23, 2026, JetBrains published security advisories to address vulnerabilities in the following products:

• JetBrains GoLand - versions prior to 2026.2
• JetBrains IntelliJ IDEA - version prior to 2026.2
• JetBrains PhpStorm - version prior to 2026.2
• JetBrains PyCharm – version prior to 2026.1.4 and 2026.2
• JetBrains TeamCity – version prior to 2026.1.2 and 2025.11.6
• JetBrains WebStorm – version prior to 2026.2

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• JetBrains – Fixed security issues

Serial number: AV26–698
Date: July 14, 2026
Updated: July 23, 2026

On July 14, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:

• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS
• .NET 8.0 installed on Windows
• .NET 9.0 installed on Linux
• .NET 9.0 installed on Mac OS
• .NET 9.0 installed on Windows
• Age of Empires II: Definitive Edition Game
• Azure Active Directory
• Azure CycleCloud 8.9.1
• Azure Monitor Agent Metrics Extension
• Azure Open AI
• Azure Spring Apps
• Azure Synapse
• Fabric Data Warehouse
• GitHub Copilot Plugin for JetBrains IDEs
• Microsoft .NET Framework
• Microsoft .NET Framework 3.5
• Microsoft .NET Framework 4.8.1
• Microsoft 365 Apps
• Microsoft 365 Apps for Enterprise
• Microsoft 365 Copilot
• Microsoft 365 Copilot for Android
• Microsoft 365 Copilot for iOS
• Microsoft Bing Search for iOS
• Microsoft Defender for Endpoint for Mac
• Microsoft Dynamics NAV 2018
• Microsoft Edge (Chromium-based)
• Microsoft Entra Provisioning Service
• Microsoft Excel 2016
• Microsoft Exchange Online
• Microsoft Exchange Server 2016
• Microsoft Exchange Server 2019
• Microsoft Exchange Server Subscription Edition RTM
• Microsoft Malware Protection Engine
• Microsoft Office 2016
• Microsoft Office 2019
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021
• Microsoft Office LTSC 2024
• Microsoft Office LTSC for Mac 2021
• Microsoft Office LTSC for Mac 2024
• Microsoft Office for Android
• Microsoft PC Manager
• Microsoft PowerPoint 2016
• Microsoft SQL Server 2016
• Microsoft SQL Server 2017
• Microsoft SQL Server 2019
• Microsoft SQL Server 2022
• Microsoft SQL Server 2025
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition
• Microsoft Surface Go 2
• Microsoft Surface Go 3
• Microsoft Surface Hub
• Microsoft Surface Hub 2S
• Microsoft Surface Hub 3
• Microsoft Surface Laptop Go
• Microsoft Surface Laptop Go 2
• Microsoft Surface Laptop Go 3
• Microsoft Surface Pro 7+
• Microsoft Surface Pro 8
• Microsoft Visual Studio 2022
• Microsoft Visual Studio 2026
• Microsoft Word 2016
• AspNet.OData
• AspNetCore.OData
• Minecraft Bedrock Dedicated Server
• Office Online Server
• Power BI Report Server
• Surface Laptop 4 with AMD Processor
• Surface Laptop 4 with Intel Processor
• Surface Windows Dev Kit
• Visual Studio Code
• Windows 10
• Windows 11
• Windows 11 Version
• Windows Admin Center
• Windows Remote Help
• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Windows Subsystem for Linux (WSL2)
• Windows Terminal for Windows 10
• Windows Terminal for Windows 11

Microsoft has indicated that CVE-2026-56164 and CVE-2026-56155 are being exploited.

On July 14, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-56164 and CVE-2026-56155 to their Known Exploited Vulnerabilities (KEV) Database.

Update 1

On July 16, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-58644 to their Known Exploited Vulnerabilities (KEV) Database.

Update 2

Open-source reporting indicates that CVE-2026-50522 is being exploited in the wild.

Update 3

On July 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-50522 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• July 2026 Security Updates
• Security Update Guide
• CISA KEV: CVE-2026-56164
• CISA KEV: CVE-2026-56155
• CISA KEV: CVE-2026-58644
• CISA KEV: CVE-2026-50522

Serial number: AV26-735
Date: July 22, 2026
Updated: July 23, 2026

On July 22, 2026, Check Point published a security advisory to address vulnerabilities in the following products. Included was a critical update for the following :

• Security Management, Multi-Domain Management – multiple versions
• Firewall, Multi-Domain Management, Multi-Domain Log Server – multiple versions

Check Point is aware that CVE-2026-16232 is being exploited in the wild.

Update 1

On July 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-16232 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• Security Advisory – Action Required – July 2026 Security Update
• Check Point Security
• CISA KEV: CVE-2026-16232

Serial number: AV26-738
Date: July 22, 2026

On July 22, 2026, Drupal published security advisories to address a vulnerability in the following product. Included was a critical update for the following:

• Internationalization Single Sign-On – versions prior to 1.8.0

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.

• Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
• Drupal Security Advisories

Serial number: AV26-737
Date: July 22, 2026

On July 22, 2026, Exim published a security advisory to address a vulnerability in the following product:

• Exim – version 4.88 to 4.99.4

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Exim Security Advisory for EXIM-Security-2026-06-22.1 / GCVE-25-2026-07-45-1
• Exim Internet Mailer

Serial number: AV26-736
Date: July 22, 2026

On July 21, 2026, Progress published security advisories to address vulnerabilities in the following product:

• ShareFile Storage Zones Controller v5 – versions prior to 5.12.4
• ShareFile Storage Zones Controller v6 – versions prior to 6.0.1

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• ShareFile Storage Zones Controller (SZC) Service Disruption Guidance, Login Issues, and Access Information
• Progress Trust Center

Serial number: AV26-734
Date: July 22, 2026

On July 22, 2026, Mitel published security advisories to address vulnerabilities in the following products. Included were critical updates for the following::

• MiCollab – multiple versions
• OpenScape UC – multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Mitel Product Security Advisory MISA-2026-0006 - MiCollab Command Injection Vulnerability
• Mitel Product Security Advisory MISA-2026-0007 - OpenScape UC Cross Reflected Site Scripting (XSS) Vulnerability
• Mitel Security Bulletins

Serial number: AV26-733
Date: July 22, 2026

On July 22, 2026, n8n published security advisories to address vulnerabilities in the following product:

• n8n – versions prior to 1.123.67
• n8n – versions prior to 2.32.1
• n8n – versions prior to 2.31.5

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary update.

• Authenticated code execution in the n8n Git node
• n8n Security

Serial number: AV26-732
Date: July 22, 2026

On July 22, 2026, ISC published security advisories to address vulnerabilities in the following products:

• ISC BIND 9 – versions 9.11.0 to 9.18.50
• ISC BIND 9 – versions 9.20.0 to 9.20.24
• ISC BIND 9 – versions 9.21.0 to 9.21.23
• BIND Supported Preview Edition – versions 9.11.3-S1 to 9.18.50-S1
• BIND Supported Preview Edition – versions 9.16.8-S1 to 9.18.50-S1
• BIND Supported Preview Edition – versions 9.18.11-S1 to 9.18.50-S1
• BIND Supported Preview Edition – versions 9.20.9-S1 to 9.20.24-S1

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• BIND 9 Security Vulnerability Matrix

Serial number: AV26-731
Date: July 22, 2026

On July 21, 2026, Atlassian published a security advisory to address vulnerabilities, including some critical ones, in the following products:

• Bamboo Data Center and Server – multiple versions
• Bitbucket Data Center and Server – multiple versions
• Confluence Data Center and Server – multiple versions
• Crowd Data Center and Server – multiple versions
• Fisheye/Crucible – versions 4.9.0 to 4.9.11
• Jira Data Center and Server – multiple versions
• Jira Service Management Data Center and Server – multiple versions
• Sourcetree for Mac – all versions from 3.4.11 to 3.4.12
• Sourcetree for Windows – all versions from 3.4.11 to 3.4.12

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Security Bulletin - July 21 2026
• Atlassian Security Advisories and Bulletins

Serial number: AV26-730
Date: July 22, 2026

On July 21, 2026, Google published a security advisory to address vulnerabilities in the following product:

• Stable Channel Chrome for Desktop – versions prior to 150.0.7871.181/.182 (Windows/Mac), and 150.0.7871.181 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.

• Google Chrome Security Advisory

Serial number: AV26-729
Date: July 22, 2026

On July 21, 2026, Oracle published a security advisory to address vulnerabilities in multiple products. Included were critical updates for the following:

• Oracle Database Server
• Oracle APEX
• Oracle Autonomous Health Framework
• Oracle Essbase
• Oracle Global Lifecycle Management
• Oracle GoldenGate
• Oracle NoSQL Database
• Oracle Spatial Studio
• Oracle SQL Developer
• Oracle TimesTen In-Memory Database
• Oracle Application Testing Suite
• Oracle Commerce
• Oracle Communications
• Oracle Construction and Engineering
• Oracle E-Business Suite
• Oracle Enterprise Manager
• Oracle Financial Services Applications
• Oracle Food and Beverage Applications
• Oracle Fusion Middleware
• Oracle Analytics
• Oracle HealthCare Applications
• Oracle Hospitality Applications
• Oracle Java SE
• Oracle JD Edwards
• Oracle MySQL
• Oracle PeopleSoft
• Oracle Retail Applications
• Oracle Siebel CRM
• Oracle Supply Chain
• Oracle Systems
• Oracle Utilities Applications
• Oracle Virtualization

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Oracle Critical Patch Update Advisory – July 2026

Serial number: AV26-728
Date: July 22, 2026

On July 21, 2026, SolarWinds published security advisories to address critical vulnerabilities in the following product:

• SolarWinds Serv-U – version 15.5.4 HF1 and prior

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• SolarWinds Security Vulnerabilities

Serial number: AV26-727
Date: July 22, 2026

On July 21, 2026, HPE published security advisories to address vulnerabilities in the following products. Include was a critical update for the following:

• HPE Aruba Networking Private 5G Core – versions 1.26.1.1 and prior
• HPE Aruba Networking EdgeConnect SD-WAN Gateways – multiple versions and platforms
• HPE Aruba Networking AOS-CX – multiple versions and platforms

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• HPESBNW05083 rev.1 - Private 5G Core, Traefik StripPrefix Route-Level Auth Bypass via Path Normalization (CVE-2026-48020)
• HPESBNW05013 rev.1 - HPE Aruba Networking EdgeConnect SD-WAN Gateways, Multiple Vulnerabilities
• HPESBNW05081 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking AOS-CX
• HPE Security Bulletin Library

Serial number: AV26-723
Date: July 20, 2026
Date: July 21, 2026

On July 17, 2026, WordPress published a security advisory to address vulnerabilities in the following product:

• WordPress 7.0 – versions prior to 7.0.2
• WordPress 6.9 – versions prior to 6.9.5
• WordPress 6.8 – versions prior to 6.8.6
• WordPress 7.1 beta – versions prior to 7.1 beta2

Open-source reporting indicates that CVE-2026-60137 and CVE-2026-63030 are being exploited in the wild.

Update 1

On July 21, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60137 and CVE-2026-63030 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query`
• REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
• WordPress 7.0.2 Release
• WordPress Releases
• CISA KEV: CVE-2026-60137
• CISA KEV: CVE-2026-63030

Serial number: AV26-726
Date: July 21, 2026

On July 21, 2026, Mozilla published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:

• Firefox ESR – versions prior to 140.13
• Firefox ESR – versions prior to 115.38
• Firefox – versions prior to 153

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Mozilla Foundation Security Advisory 2026-70
• Mozilla Foundation Security Advisory 2026-69
• Mozilla Foundation Security Advisory 2026-68
• Mozilla Security Advisories

Serial number: AV26-725
Date: July 21, 2026

On July 21, 2026, Zyxel published a security advisory to address a vulnerability in the following products:

• DSL/Ethernet CPE – multiple versions and models
• Fiber ONTs – multiple versions and models
• Wireless Extenders – multiple versions and models

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Zyxel security advisory for post-authentication command injection vulnerability in certain DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders
• Zyxel Advisories

Serial number: AV26-724
Date: July 21, 2026

On July 20, 2026, Tenable published a security advisory to address critical vulnerabilities in the following product:

• Tenable Security Center – version 6.6.0 to 6.8.0

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• [R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2 and 6.8.0: SC202607.1
• Tenable Product Security Advisories

Serial number: AV26-722
Date: July 20, 2026

On July 20, 2026, HPE published a security advisory to address vulnerabilities in the following product:

• HPE Telco Automated Assurance – version v1.4 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• HPESBNW05082 rev.1 - HPE Telco Automated Assurance, Multiple Vulnerabilities
• HPE Security Bulletin Library

Serial number: AV26-693
Date: July 14, 2026
Updated: July 20, 2026

On July 13, 2026, ServiceNow published a security advisory to address a critical vulnerability in the following products:

• Brazil - versions prior to Brazil EA and Brazil GA
• Australia - versions prior to Australia Patch 2
• Zurich - versions prior to Zurich Patch 7b and Zurich Patch 9
• Yokohama - versions prior to Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13

Update 1

Open-source reporting indicates that CVE-2026-6875 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• [Security Advisory] CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platform
• ServiceNow security advisories