Serial number:AV26-435
Date:May 7, 2026

On May 7, 2026, Ivanti published a security advisory to address vulnerabilities in the following product:

• Ivanti Endpoint Manager Mobile (EPMM) – versions prior to 12.6.1.1
• Ivanti Endpoint Manager Mobile (EPMM) – versions prior to 12.7.0.1
• Ivanti Endpoint Manager Mobile (EPMM) – versions prior to 12.8.0.1

Ivanti has indicated that CVE-2026-6973 has been exploited.

On May 7, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-6973 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (Multiple CVEs)
• Ivanti Security Advisories
• CISA KEV: CVE-2026-6973

Serial number:AV26-434
Date:May 7, 2026

Between May 6 and 7, 2026, Broadcom published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:

• Tanzu Greenplum Command Center – versions prior to 6.17.0
• Tanzu Greenplum Command Center – versions prior to 7.7.0
• Tanzu Greenplum Data Copy Utility – versions prior to 2.9.3
• Tanzu for MySQL on Kubernetes – versions prior to 2.0.3
• Tanzu Greenplum Streaming Server for Kubernetes – versions prior to 1.3.0
• Tanzu Greenplum Streaming Server – versions prior to 2.3.0
• Tanzu Greenplum Streaming on Kubernetes – versions prior to 1.1.0
• Tanzu Greenplum Text – versions prior to 4.0.0
• Tanzu for Valkey on Kubernetes – versions prior to 3.3.4
• Tanzu for Valkey on Kubernetes – versions prior to 3.4.0

The Cyber Centre encourages users and administrators to review the web link provided and apply the necessary updates.

• Security Advisories Tanzu

Serial number:AV26-433
Date:May 7, 2026

On May 7, 2026, Mozilla published security advisories to address vulnerabilities in the following products:

• Firefox  – versions prior to 150.0.2
• Firefox ESR – versions prior to 140.10.2
• Firefox ESR – versions prior to 115.35.2

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Mozilla Foundation Security Advisory 2026-40
• Mozilla Foundation Security Advisory 2026-41
• Mozilla Foundation Security Advisory 2026-42
• Mozilla Security Advisories

Serial number:AV26-432
Date:May 7, 2026

On May 4, 2026, Patrik Simek published security advisories to address critical vulnerabilities in the following product:

• VM2 Node.js sandboxing library – versions prior to 3.11.2

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• VM2 v3.11.2
• VM2 security advisories

Serial number:AV26-431
Date:May 7, 2026

On May 6, 2026, Spring published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following:

• Spring Cloud Config – multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• CVE-2026-40981: Spring Cloud Config Clients Can Access Secrets From Any Project The Config Server Has Access To On Google Secrets Manager Server Has Access To On Google Secrets Manager
• CVE-2026-40982: Directory Traversal with spring-cloud-config-server
• CVE-2026-41002: Spring Cloud Config Server Susceptible To TOCTOU Attack
• Spring Security Advisories

Serial number:AV26-430
Date: May 6, 2026

On May 6, 2026, Cisco published security advisories to address vulnerabilities in multiple products. Included were updates for the following:

• Cisco Crosswork Network Controller (CNC) – version 7.1 and prior
• Cisco IoT Field Network Director (FND) – version 4 and prior
• Cisco IoT Field Network Director (FND) – versions prior to 5.0.0-117
• Cisco Network Services Orchestrator (NSO) – version 6.3 and prior
• Cisco Network Services Orchestrator (NSO) – versions prior to 6.4.1.3
• Cisco SG350 and SG350X Managed Switch – multiple versions and models
• Cisco Unity Connection – versions prior to 12.5
• Cisco Unity Connection – versions prior to 14SU5
• Cisco Unity Connection – versions prior to 15SU4

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested recommendations, and apply the necessary updates when available.

• Cisco Unity Connection Remote Code Execution and Server-Side Request Forgery Vulnerabilities
• Cisco SG350 and SG350X Series Managed Switches SNMP Denial of Service Vulnerability
• Cisco Crosswork Network Controller and Cisco Network Services Orchestrator Connection Exhaustion Denial of Service Vulnerability
• Cisco IoT Field Network Director Vulnerabilities
• Cisco Security Advisories