30
30
30
30
n8n security advisory (AV26-916)
Canadian Cyber Centre advisory AV26-916 warns n8n before versions 2.37.7, 2.38.2, and 1.123.76 is affected by an undisclosed vulnerability; patch required.
The Canadian Centre for Cyber Security issued advisory AV26-916 on September 11, 2026, stating that n8n is affected by a vulnerability in versions prior to 2.37.7, 2.38.2, and 1.123.76. Fixed releases [email protected], [email protected], and [email protected] are available via GitHub. No CVE identifier or exploitation details are provided; administrators are urged to review linked resources and apply updates.
22
[Control systems] GeoVision security advisory (AV26-913)
Canada's Cyber Centre (AV26-913) warns GeoVision GV-LPC2011/LPC2211 firmware 1.13 license-plate cameras are affected by vulnerabilities and urges updates.
The Canadian Centre for Cyber Security issued control-systems advisory AV26-913 on September 11, 2026, noting that GeoVision GV-LPC2011/LPC2211 firmware version 1.13 is affected by vulnerabilities. The bulletin references the vendor advisory GV-LPC-2026-09-01 but provides no CVE identifiers or exploitation details. Administrators are encouraged to review the linked advisories and apply updates as they become available.
15
MongoDB security advisory (AV26-911)
Canada's Cyber Centre warns MongoDB Java Driver and Laravel MongoDB (PHP) have vulnerabilities fixed in versions 5.11.1 and 5.11.0.
The Canadian Centre for Cyber Security (AV26-911) reports MongoDB vulnerabilities affecting the Java Driver prior to 5.11.1 and Laravel MongoDB (PHP) prior to 5.11.0. Fixed issues include a native heap use-after-free during cancellation racing a KMS credential fetch in reactive encryption (JAVA-6276) and a query builder fix forcing literal equality when 3-arg where clauses use '=' with array values (PHPLARA-260). Administrators are urged to review the advisories and apply the updates.
24
HashiCorp security advisory (AV26-910)
Canada's Cyber Centre warns HashiCorp Consul and consul-template have authorization bypass and information disclosure flaws, urging users to apply available updates.
Advisory AV26-910 relays HashiCorp security advisories HCSEC-2026-34, HCSEC-2026-37 and HCSEC-2026-38 covering Consul and consul-template. Consul has an authorization bypass in the catalog node-write path and another in the Connect service mesh, while consul-template has an information disclosure issue in error handling. Fixed versions include Consul 2.0.4, Consul Enterprise 1.21.18 and consul-template 0.43.0. The Cyber Centre encourages users and administrators to review the linked advisories and apply updates.
25
MISP security advisory (AV26-901)
Canada's Cyber Centre warns MISP versions up to 2.5.45 are affected by vulnerabilities and urges users to apply available updates.
The Canadian Centre for Cyber Security issued advisory AV26-901 on September 9, 2026, stating that as of September 4, MISP releases at or prior to 2.5.45 are affected by vulnerabilities. The notice provides no CVE identifiers or exploitation details and directs users and administrators to review the vendor bulletin and apply updates as they become available.
25
Commvault security advisory (AV26-899)
Canadian Cyber Centre warns Commvault Cloud versions prior to 11.36.123, 11.40.72, 11.44.20, and 11.46.20 are affected by vulnerabilities; updates required.
The Canadian Centre for Cyber Security issued advisory AV26-899 stating that Commvault Cloud is affected by vulnerabilities as of September 8, 2026. Affected branches are 36.0 before 11.36.123, 40.0 before 11.40.72, 44.0 before 11.44.20, and 46.0 before 11.46.20. The advisory links to Commvault's own security advisories and urges administrators to apply available updates; no CVE identifiers, severity ratings, or exploitation details are provided.
25
SonicWall security advisory (AV26-884)
Canada's Cyber Centre issued advisory AV26-884 warning that SonicWall Network Security Manager On-Prem 4.3.0 and earlier are affected by multiple vulnerabilities.
The Canadian Centre for Cyber Security published advisory AV26-884 on September 4, 2026, flagging SonicWall Network Security Manager (NSM) On-Prem across VMware, Hyper-V, Azure, and KVM deployments, versions 4.3.0 and earlier, as affected by multiple vulnerabilities. The advisory does not list CVE identifiers, exploit details, or in-the-wild exploitation. Administrators are encouraged to review the referenced links and apply updates as they become available.
15
OPCFoundation OPC UA LocalDiscoveryServer (LDS)
CISA warns CVE-2026-77477 (CVSS 4.6) lets local attackers hijack a privileged console during OPC UA LDS installation below version 1.04.420.
CISA published ICSA-26-246-01 for CVE-2026-77477, CWE-250 execution with unnecessary privileges in OPC Foundation UA-LDS-Installers below 1.04.420. An attacker able to launch the installer with elevated privileges and access the keyboard and display can intercept a high-privilege console window during installation and run arbitrary commands. CVSS 3.1 score is 4.6, the issue is not remotely exploitable, and no public exploitation has been reported. Lukas Schumaker of Rockwell Automation reported the flaw to OPC Foundation.
15
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
Cisco warns of a DoS flaw in SIP software on Desk Phone 9800 and IP Phone 7800/8800 series from improper HTTP packet memory handling.
Cisco disclosed a denial of service vulnerability affecting Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 devices running Cisco SIP Software. An unauthenticated remote attacker can send a continuous stream of crafted HTTP packets, causing sustained memory consumption until the device becomes unresponsive. A manual reboot is required to recover an affected device. No CVE identifier was listed in the advisory text.
20
Grafana security advisory (AV26-860)
Canada's Cyber Centre warned that Grafana Alloy versions through 1.18.1 are affected by CVE-2026-19516 and urged users to apply available updates.
Canada's Cyber Centre issued advisory AV26-860 warning that Grafana Alloy versions prior to or equal to 1.18.1 are affected by CVE-2026-19516. The bulletin directs users and administrators to vendor resources and available patches. No exploitation or severity details are included in the advisory text.
25
Rockwell Automation OTTO Fleet Manager
CISA warns Rockwell Automation OTTO Fleet Manager (CVE-2026-75112, CVSS 6.8) uses insufficiently costly password hashing, easing offline brute-force attacks.
CISA published ICS advisory ICSA-26-239-03 for Rockwell Automation OTTO Fleet Manager versions 2.36.2 and earlier (CVE-2026-75112, CVSS v3 6.8). The flaw involves use of a password hash with insufficient computational effort, reducing the cost for an attacker to perform offline brute-force attacks against stored password hashes. Deployments span critical manufacturing and transportation systems sectors worldwide, with company headquarters in the United States.
18
Mitsubishi Electric Multiple FA Products (Update D)
CISA warns Mitsubishi Electric CC-Link IE TSN remote I/O modules are vulnerable to denial-of-service via crafted UDP packets (CVE-2025-3511).
CISA published Update D of advisory ICSA-25-128-03 covering Mitsubishi Electric factory automation products. Affected products include CC-Link IE TSN Remote I/O modules NZ2GN2S1-32D, NZ2GN2S1-32T, NZ2GN2S1-32TE, and NZ2GN2S1-32DT at firmware version 09 or earlier (CVE-2025-3511). A remote attacker can send a specially crafted UDP packet to cause denial-of-service conditions, timeout errors, or communication delays on the affected products.
20
Applied Systems Engineering ASE2000 V2 Communications Test Set
CISA warns ASE2000 V2 test sets allow arbitrary file read/write, outbound request abuse, and TLS peer impersonation; version 2.38 fixes both vulnerabilities.
CISA published ICS advisory ICSA-26-239-04 for Applied Systems Engineering (Kalkitech) ASE2000 V2 Communications Test Set versions 2.25 through 2.37. Exploitation could allow reading or writing arbitrary local files, forcing outbound network requests, or intercepting the TLS connection to impersonate the trusted peer and read or modify protected communications. Vendor ASE/Kalkitech provides upgraded version 2.38, which also updates the bundled log4net library, fixing both vulnerabilities; customers are advised to upgrade.
18
30
30
30
Jenkins Security Advisory 2026-09-16
Jenkins released a security advisory patching vulnerabilities across 13 plugins, including GitLab, Bitbucket, Gradle, Keycloak Authentication, and Script Security.
The Jenkins security advisory dated September 16, 2026 addresses vulnerabilities in 13 plugins: Bitbucket Push and Pull Request, Bitbucket Server Integration, Coverage, Gitee, GitLab, Gradle, Keycloak Authentication, OWASP Dependency-Check, Pipeline: Groovy Libraries, Pipeline: Multibranch, Robot Framework, Script Security, and Warnings. Jenkins users should update the affected plugins to the patched versions listed in the advisory.
28
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30