Serial number:AV26-1067
Date:October 20, 2026

As of October 19, 2026, Craft CMS is affected by vulnerabilities in the following product:

• Craft CMS
  • Prior to 4.18.8
  • Prior to 5.11.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Authenticated RCE via Twig group filter array-callable
• Twig sandbox allowlist bypass discloses sensitive values
• Authenticated RCE: Twig sandbox "on/as" behavior injection via "Asset::getMimeType" transform
• Authenticated RCE: Twig sandbox "on/as" behavior injection via uncleansed "getNext/getPrev/getOwners" criteria
• Authenticated admin RCE via Content Block field-layout JSON-string cleanse
• Craft CMS Security Advisories

Serial Number:AV26-845
Date:August 25, 2026
Updated:October 20, 2026

As of August 14, 2026, Gitea is affected by vulnerabilities in the following product:

• Gitea
  • Prior to 1.27.1

Update 1
Open-source reporting indicates that CVE-2026-20896 is being exploited in the wild.

On August 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60004 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Remote Code Execution via diffpatch Git Hook Installation
• Gitea 1.27.1 is released
• Gitea 1.27.2 is released
• CISA KEV: CVE-2026-60004

Serial number:AV26-1066
Date:October 20, 2026

As of October 19, 2026, GeoVision is affected by a vulnerability in the following product:

• GV-ASManager
  • Versions prior to V6.3.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• GeoVision Security Advisory - GV-ASM-2026-10-01 (PDF)
• Cyber Security - GeoVision

Serial number:AV26-1065
Date:October 20, 2026

As of October 20, 2026, Advantech is affected by vulnerabilities in the following product:

• ADAM-3600
  • Versions prior to v2.8.5.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisories - Vulnerabilities Identified in ADAM-3600 (PDF)
• Advantech Security Advisories

Serial number:AV26-1064
Date:October 20, 2026

As of October 19, 2026, IBM is affected by vulnerabilities in the following products:

• IBM Concert
  • Prior to or equal to 3.0.0
• IBM MQ Advanced container images
  • Multiple versions
• IBM MQ Operator
  • Multiples versions
• IBM Sterling Connect Direct for Unix
  • Prior to or equal to 6.3.0.7
  • Prior to or equal to 6.4.0.6
• IBM i
  • Versions 7.3, 7.4, 7.5 and 7.6

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• IBM Product Security Incident Response