60
55
Dell security advisory (AV26-886)
Canada's Cyber Centre flags September 2026 Dell vulnerabilities across iDRAC9/iDRAC10, OpenManage, PowerEdge, Avamar, NetWorker VE, PowerProtect, IDPA and PowerScale OneFS.
Canadian Centre for Cyber Security advisory AV26-886 lists Dell vulnerabilities across iDRAC9, iDRAC10, OpenManage Network Integration, PowerEdge servers, the OpenManage Python SDK, Avamar, NetWorker Virtual Edition, PowerProtect DP Series, IDPA and PowerScale OneFS. Fixed versions include iDRAC9 7.30.10.50, iDRAC10 1.30.30.50 and OpenManage Network Integration 3.10. No CVE identifiers or exploitation status are provided; administrators are urged to apply the vendor updates.
32
30
GitLab security advisory (AV26-917)
Canada's Cyber Centre warns GitLab versions before 19.1.8, 19.2.6 and 19.3.2 are affected; CISA added CVE-2026-85706 to KEV.
The Canadian Centre for Cyber Security issued advisory AV26-917 on September 11, 2026, warning that GitLab versions prior to 19.1.8, 19.2.6, and 19.3.2 are affected by vulnerabilities. CISA added CVE-2026-85706 to its Known Exploited Vulnerabilities catalog on the same date. The Cyber Centre urges users and administrators to review the advisory links and apply GitLab's critical patch release updates.
72
[Control Systems] National Instruments security advisory (AV26-914)
Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.
Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.
22
[Control systems] GeoVision security advisory (AV26-913)
Canada's Cyber Centre (AV26-913) warns GeoVision GV-LPC2011/LPC2211 firmware 1.13 license-plate cameras are affected by vulnerabilities and urges updates.
The Canadian Centre for Cyber Security issued control-systems advisory AV26-913 on September 11, 2026, noting that GeoVision GV-LPC2011/LPC2211 firmware version 1.13 is affected by vulnerabilities. The bulletin references the vendor advisory GV-LPC-2026-09-01 but provides no CVE identifiers or exploitation details. Administrators are encouraged to review the linked advisories and apply updates as they become available.
15
[Control systems] Schneider Electric security advisory (AV26-912)
Canada's Cyber Centre relays a Schneider Electric advisory covering multiple vulnerabilities in EcoStruxure IT Data Center Expert and PowerLogic T300, urging users to apply updates.
The Canadian Centre for Cyber Security issued advisory AV26-912 noting that as of September 9, 2026 Schneider Electric is affected by vulnerabilities in EcoStruxure IT Data Center Expert versions 9.1.2 and prior, and PowerLogic T300 versions 2.9.8-5620 and prior. The issues include an improper neutralization of special elements used in an OS command on the PowerLogic T300. The advisory recommends reviewing vendor notifications, performing suggested mitigations, and applying necessary updates.
18
MongoDB security advisory (AV26-911)
Canada's Cyber Centre warns MongoDB Java Driver and Laravel MongoDB (PHP) have vulnerabilities fixed in versions 5.11.1 and 5.11.0.
The Canadian Centre for Cyber Security (AV26-911) reports MongoDB vulnerabilities affecting the Java Driver prior to 5.11.1 and Laravel MongoDB (PHP) prior to 5.11.0. Fixed issues include a native heap use-after-free during cancellation racing a KMS credential fetch in reactive encryption (JAVA-6276) and a query builder fix forcing literal equality when 3-arg where clauses use '=' with array values (PHPLARA-260). Administrators are urged to review the advisories and apply the updates.
24
HashiCorp security advisory (AV26-910)
Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.
Advisory AV26-910 relays HashiCorp security advisories HCSEC-2026-34, HCSEC-2026-37 and HCSEC-2026-38 covering Consul and consul-template. Consul has an authorization bypass in the catalog node-write path and another in the Connect service mesh, while consul-template has an information disclosure issue in error handling. Fixed versions include Consul 2.0.4, Consul Enterprise 1.21.18 and consul-template 0.43.0. The Cyber Centre encourages users and administrators to review the linked advisories and apply updates.
25
HPE security advisory (AV26-909)
Canada's Cyber Centre relayed HPE advisories covering vulnerabilities in Aruba ClearPass Policy Manager and HPE IceWall products.
Canadian Centre for Cyber Security advisory AV26-909, dated September 10, 2026, flags vulnerabilities in HPE products disclosed on September 9, 2026. Affected products include Aruba ClearPass Policy Manager versions prior to or equal to 6.11.14 and 6.12.8, and multiple HPE IceWall versions and models. Bulletins cover multiple ClearPass vulnerabilities, a remote bypass of security restrictions in IceWall, and an IceWall denial-of-service vulnerability; administrators are urged to review the bulletins and apply updates.
30
WebPros security advisory (AV26-908)
Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.
The Canadian Centre for Cyber Security published advisory AV26-908 covering vulnerabilities in WebPros products, including cPanel & WHM and ConfigServer Security & Firewall (CSF). Affected cPanel builds include versions prior to 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP2 11.138.1.9, while CSF versions 14.00-16.29 (CVE-2026-65638) and 2.15-16.29 (CVE-2026-65639) are also affected. CVE-2026-67401 describes SQL injection in cPanel's EmailTrack functionality. Users and administrators are encouraged to review the advisories and apply available updates.
38
Adobe security advisory (AV26-808) – Update 1
Canada's Cyber Centre updated Adobe advisory AV26-808 to flag that CVE-2026-71362 in Adobe Commerce is being exploited in the wild.
The Canadian Centre for Cyber Security advisory AV26-808 (Update 1) lists vulnerabilities affecting Adobe products including Campaign Classic, Adobe Commerce, Magento Open Source, ColdFusion 2023/2025, Lightroom Classic, and Content Credentials SDKs. Update 1 notes that open-source reporting indicates CVE-2026-71362 is being exploited in the wild. Users and administrators are urged to review the referenced links and apply updates, including those in Adobe bulletin APSB26-92 for Adobe Commerce.
55
[Control systems] Advantech security advisory (AV26-907)
Canada's Cyber Centre flagged vulnerabilities in the Advantech WISE-6610 industrial gateway and urged users to apply available updates.
Advisory AV26-907, dated September 10, 2026, states that multiple versions and models of the Advantech WISE-6610 industrial gateway are affected by vulnerabilities. The Canadian Centre for Cyber Security encourages users and administrators to review the provided links and apply updates as they become available. No CVE identifiers or exploitation details were included in the announcement.
20
Fortra security advisory (AV26-906)
Canada's Cyber Centre advises that Fortra GoAnywhere MFT Endpoint versions prior to 7.10.2 are affected by a path traversal vulnerability.
The Canadian Centre for Cyber Security issued advisory AV26-906 noting that Fortra GoAnywhere MFT Endpoint versions prior to 7.10.2 are affected by a path traversal vulnerability. The advisory was published September 10, 2026, referencing Fortra's own security advisory. No exploitation details or CVE id are provided; administrators are urged to review the links and apply the 7.10.2 update.
30
Palo Alto Networks security advisory (AV26-905)
Canada's Cyber Centre relayed Palo Alto Networks advisories covering PAN-OS, Cloud NGFW, Prisma Access, and Prisma Browser vulnerabilities, including PAN-OS CVE-2026-0310 buffer overflow.
The Canadian Centre for Cyber Security issued advisory AV26-905, noting that as of September 10, 2026, multiple Palo Alto Networks products are affected by vulnerabilities. Affected products include Cloud NGFW on AWS and Azure, multiple PAN-OS versions, Prisma Access, and Prisma Browser prior to 151.26.5.170. The advisory references CVE-2026-0310, a PAN-OS buffer overflow via XML processing (PAN-SA-2026-0012), and the September 2026 Chromium monthly vulnerability update. Administrators are encouraged to review the vendor links and apply available updates.
20
Check Point security advisory (AV26-902)
Canada's Cyber Centre issued advisory AV26-902 warning of two Check Point RCE flaws, including VPN authentication bypass CVE-2026-85102.
The Canadian Centre for Cyber Security released advisory AV26-902 on September 9, 2026, covering vulnerabilities in Check Point Security Gateway, Spark Firewall with Site-to-Site or Remote Access VPN, and Security Management Server across multiple versions. CVE-2026-85102 is an authentication bypass and remote code execution flaw in Remote Access and Site-to-Site VPN, while CVE-2026-85103 is an ASN.1 decoding heap overflow enabling remote code execution. Administrators are urged to review the linked advisories and apply updates as they become available.
52
MISP security advisory (AV26-901)
Canada's Cyber Centre warns MISP versions up to 2.5.45 are affected by vulnerabilities and urges users to apply available updates.
The Canadian Centre for Cyber Security issued advisory AV26-901 on September 9, 2026, stating that as of September 4, MISP releases at or prior to 2.5.45 are affected by vulnerabilities. The notice provides no CVE identifiers or exploitation details and directs users and administrators to review the vendor bulletin and apply updates as they become available.
25
NVIDIA security advisory (AV26-900)
Canada's Cyber Centre flags NVIDIA Triton Inference Server versions through 26.03 and 26.06 as vulnerable, urging review of the September 2026 bulletin.
The Canadian Centre for Cyber Security issued advisory AV26-900 on September 9, 2026, noting that as of September 8, NVIDIA Triton Inference Server versions 0.0 to 26.03 and 0.0 to 26.06 are affected by vulnerabilities. The advisory includes no CVE identifiers or severity details and directs users to review NVIDIA's September 2026 Triton security bulletin and apply available updates.
32
Ivanti security advisory (AV26-897)
Canada's Cyber Centre relayed Ivanti's September 2026 security updates for Endpoint Manager Mobile, Neurons for ITSM, and Sentry, urging administrators to patch.
The Canadian Centre for Cyber Security forwarded Ivanti's September 2026 security updates covering Endpoint Manager Mobile, Neurons for ITSM (cloud/SaaS and on-prem), and Sentry. Affected releases include Endpoint Manager Mobile prior to 12.10.0.0, Sentry prior to R10.8.2, and Neurons for ITSM on-prem prior to 2026.2. The advisory references CVE-2026-18851 for Endpoint Manager Mobile and CVE-2026-83527 for Sentry, plus multiple CVEs in Neurons for ITSM. No exploitation is described in the advisory text.
32
Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1
Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.
Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.
65
Commvault security advisory (AV26-895)
Canada's Cyber Centre advisory AV26-895 warns Commvault Cloud builds before 11.36.123/11.40.72/11.44.20/11.46.20 are affected by a Command Center API authentication bypass.
The Canadian Centre for Cyber Security alerted users that Commvault Cloud versions 11.36, 11.40, 11.44 and 11.46, prior to fixed builds 11.36.123, 11.40.72, 11.44.20 and 11.46.20, are affected by issue CV_2026_07_1, a Command Center API authentication bypass. Administrators are encouraged to review the linked vendor advisories and apply the available updates.
32
SAP security advisory – September 2026 monthly rollup (AV26-894)
Canada's Cyber Centre relayed SAP's September 2026 Patch Day rollup covering vulnerabilities across NetWeaver, kernel components, CAP, and Integration Suite.
The Canadian Centre for Cyber Security published advisory AV26-894 noting that as of September 8, 2026, SAP is affected by vulnerabilities in multiple products, including SAP Extended Passport, NetWeaver Message Server, SAP Cloud Application Programming Model, SAP GUI for Java, Integration Suite Cloud Integration, NetWeaver Business Client, and NetWeaver AS for ABAP. The advisory corresponds to SAP Security Patch Day September 2026 and lists many affected kernel and web dispatcher versions. Administrators are urged to review the SAP advisory and apply updates as available.
30
Hitachi security advisory (AV26-893)
Canada's Cyber Centre flagged a Hitachi Cosminexus Component Container vulnerability and urged users to apply available updates.
The Canadian Centre for Cyber Security issued advisory AV26-893 stating that as of September 8, 2026, Hitachi is affected by a vulnerability in Cosminexus Component Container across multiple versions and models. The advisory points to Hitachi's vulnerability information page and recommends that users and administrators review the provided links and apply necessary updates when available.
18
[Control Systems] Inductive Automation security advisory (AV26-892)
Canada's Cyber Centre relayed a CISA ICS advisory for an Inductive Automation Ignition vulnerability affecting versions up to 8.1.53.
The Canadian Centre for Cyber Security published control systems advisory AV26-892, noting that as of September 4, 2026, Inductive Automation is affected by a vulnerability in Ignition versions prior to or equal to 8.1.53. The advisory references CISA's ICS advisory (ICSA-26-246-06) and its CSAF file, and encourages users and administrators to review the linked resources and apply necessary updates as they become available. Ignition is a widely deployed industrial automation platform, so affected OT operators should patch promptly.
32
JetBrains security advisory (AV26-891)
Canada's Cyber Centre relayed a JetBrains advisory covering vulnerabilities in GoLand, Hub, IntelliJ IDEA and YouTrack.
Advisory AV26-891, dated September 8, 2026, notes JetBrains vulnerabilities affecting GoLand prior to 2026.2.2.1, Hub prior to 2026.2.52442, IntelliJ IDEA prior to 2026.2.2, and multiple YouTrack versions. Users and administrators are encouraged to review JetBrains' advisory and apply any necessary updates. No specific CVEs or exploitation details are provided in the relayed advisory.
20
[Control Systems] Siemens security advisory (AV26-890)
Canada's Cyber Centre relayed a Siemens advisory affecting Reyrolle 7SR5, Teamcenter, Siveillance Control, Desigo CC and other products.
Advisory AV26-890, dated September 8, 2026, flags Siemens vulnerabilities in Reyrolle 7SR5 (versions prior to V2.70), Teamcenter, Siveillance Control, SIMATIC AX Runtime, Desigo CC, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT across multiple versions and models. The Cyber Centre encourages users and administrators to review the Siemens advisory and apply available updates. No specific CVEs or exploitation details are provided in the relayed advisory.
18
OpenVPN security advisory (AV26-889)
Canada's Cyber Centre advisory AV26-889 flags CVE-2026-84732 in OpenVPN 2.6.22 and earlier and 2.7.6 and earlier, urging administrators to apply updates.
The Canadian Centre for Cyber Security issued advisory AV26-889 noting that OpenVPN versions up to and including 2.6.22 and 2.7.6 are affected by CVE-2026-84732. The flaw involves unbounded TLS timeouts and acknowledgements for non-outstanding packets in the reliability layer. Administrators are encouraged to review the linked OpenVPN guidance and apply updates as they become available. No exploitation is reported.
15
Adobe security advisory (AV26-888)
Canada's Cyber Centre warns CVE-2026-75650 in Adobe Commerce and Magento Open Source is exploited in the wild; hotfixes and updates are available.
Canadian Centre for Cyber Security advisory AV26-888 (September 8, 2026) covers CVE-2026-75650 in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Adobe states the vulnerability is being exploited in the wild. Affected versions extend through the August 2026 patch levels across the 2.4.4-2.4.9 branches, with B2B versions 1.3.x-1.5.x also affected. Administrators are urged to apply the available hotfixes and updates.
68
Mikrotik security advisory (AV26-887)
Canada's Cyber Centre urges MikroTik RouterOS updates as CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 are reported exploited in the wild.
Canadian Centre for Cyber Security advisory AV26-887 covers MikroTik RouterOS vulnerabilities affecting versions prior to 6.49.21, 7.23.4, 7.24.2 and 7.25 beta 3. Open-source reporting indicates CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 are being exploited in the wild. The Cyber Centre urges users and administrators to review the vendor advisories and apply the necessary updates.
70
SonicWall security advisory (AV26-884)
Canada's Cyber Centre issued advisory AV26-884 warning that SonicWall Network Security Manager On-Prem 4.3.0 and earlier are affected by multiple vulnerabilities.
The Canadian Centre for Cyber Security published advisory AV26-884 on September 4, 2026, flagging SonicWall Network Security Manager (NSM) On-Prem across VMware, Hyper-V, Azure, and KVM deployments, versions 4.3.0 and earlier, as affected by multiple vulnerabilities. The advisory does not list CVE identifiers, exploit details, or in-the-wild exploitation. Administrators are encouraged to review the referenced links and apply updates as they become available.
15
n8n security advisory (AV26-880)
Canada's Cyber Centre flagged multiple n8n vulnerabilities in versions prior to 1.123.76 and several 2.x releases, urging users to update.
The Canadian Centre for Cyber Security issued advisory AV26-880 stating that n8n is affected by vulnerabilities in versions prior to 1.123.76 and prior to 2.35.4, 2.36.2, 2.37.7, and 2.38.2. The advisory links to the n8n-io GitHub repository for details. Users and administrators are encouraged to review the advisory and apply the necessary updates.
22
F5 security advisory (AV26-878)
Canada's Cyber Centre relayed an F5 advisory (AV26-878) covering vulnerabilities in BIG-IP, BIG-IQ, NGINX components, and APM clients.
The Canadian Centre for Cyber Security published advisory AV26-878 noting F5 vulnerabilities affecting BIG-IP all modules prior to 17.1.3.4, 17.5.1.8, 21.0.0.3, and 21.1.0.1, plus BIG-IQ prior to 8.4.2.1, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX JavaScript 9.9, and APM clients. F5 issued an out-of-band security notification (K000162872) on September 2, 2026. Administrators are encouraged to review the linked advisory and apply updates as they become available.
28
Jenkins security advisory (AV26-877)
Canada's Cyber Centre relayed a Jenkins advisory (AV26-877) covering core and numerous plugin vulnerabilities fixed in 2.568.3/2.580.
The Canadian Centre for Cyber Security published advisory AV26-877 for the Jenkins security advisory dated September 2, 2026. Affected products include Jenkins releases other than 2.568.3 and 2.580, plus plugins such as GitLab, LDAP, Microsoft Entra ID, SAML, Script Security, Pipeline Build Step, and others. Administrators are encouraged to review the linked advisory and apply necessary updates.
24
Cisco security advisory (AV26-876)
Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.
The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.
26
Progress Software security advisory (AV26-875)
Canada's Cyber Centre warns Progress Telerik UI for ASP.NET AJAX before 2026.3.812 is affected by path traversal and upload tampering flaws, urging updates.
The Canadian Centre for Cyber Security issued advisory AV26-875 on September 2, 2026, covering vulnerabilities in Progress Software Telerik UI for ASP.NET AJAX prior to version 2026.3.812. Two flaws are listed: CVE-2026-18672, a path traversal in the Telerik Web Forms RadImageEditor, and CVE-2026-19219, a DialogHandler UploadPaths tampering vulnerability. Administrators are encouraged to review the provided links and apply available updates.
30
Google security advisory (AV26-874)
Canada's Cyber Centre relayed a Google advisory urging users to update Chrome to 152.0.7977.75 or later to fix unspecified vulnerabilities.
The Canadian Centre for Cyber Security issued advisory AV26-874 on September 2, 2026, noting vulnerabilities affecting Google Chrome prior to version 152.0.7977.75. The advisory points to Google's Stable Channel Update for Desktop and encourages users and administrators to review the vendor link and apply updates as they become available.
30
HPE security advisory (AV26-873)
Canada's Cyber Centre relays HPE advisories covering multiple vulnerabilities in Aruba AOS-CX switches and Fabric Composer, urging updates.
The Canadian Centre for Cyber Security issued advisory AV26-873 noting multiple vulnerabilities in HPE Aruba Networking AOS-CX and Fabric Composer. Affected versions span AOS-CX releases through branches 10.10, 10.13, 10.16, 10.17, and 10.18, and Fabric Composer through 7.3.3. Administrators are urged to review HPE bulletins HPESBNW05133 and HPESBNW05134 and apply available updates.
14
[Control systems] Schneider Electric security advisory (AV26-871)
Canada's Cyber Centre relayed Schneider Electric advisories for vulnerabilities in NetBotz 5-750/755 (5.5.2 and prior) and PowerChute Serial Shutdown (1.5 and prior).
The Canadian Centre for Cyber Security issued control-systems advisory AV26-871 noting Schneider Electric products affected by vulnerabilities as of September 1, 2026. Affected products include NetBotz 5-750/755 versions 5.5.2 and prior, and PowerChute Serial Shutdown versions 1.5 and prior, the latter with an improper restriction of excessive authentication attempts flaw. Administrators are urged to review Schneider Electric's security notifications and apply the suggested mitigations and updates.
24
Erlang security advisory (AV26-870)
Canada's Cyber Centre warns that multiple Erlang/OTP versions are affected by vulnerabilities and urges administrators to apply updates.
The Canadian Centre for Cyber Security issued advisory AV26-870 on September 1, 2026, noting vulnerabilities affecting Erlang OTP across multiple versions. The bulletin contains no CVE identifiers or exploitation details and directs users and administrators to Erlang's own security advisories to apply necessary updates.
25