Serial number:AV26-503
Date: May 25, 2026
Updated: September 21, 2026

On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product: 

• Roundcube Webmail – versions prior to 1.6.16
• Roundcube Webmail – versions prior to 1.7.1

Update 1

Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Roundcube Webmail 1.6.16
• Roundcube Webmail 1.71
• Roundcube Open Source Webmail Software

Serial number:AV26-603
Date:June 16, 2026
Updated: September 21, 2026

On June 16, 2026, Zyxel published a security advisory to address vulnerabilities in the following products:

• GS1900 series switches – multiple versions and models

Update 1

On September 21, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches
• Zyxel Advisories
• CISA KEV: CVE-2026-7273

Serial number:AV26-513
Date: May 27, 2026
Updated: September 21, 2026

On May 27, 2026, Veeam published security advisories to address vulnerabilities in the following products:

• Veeam Backup & Replication – 13 versions prior to 13.0.2.29
• Veeam ONE – versions prior to 13.0.2.6723
• Veeam Service Provider Console – 9.2 versions prior to 9.2.1.33875

Update 1

Open-source reporting indicates that CVE-2026-32996 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Vulnerabilities Resolved in Veeam Backup & Replication 13.0.2
• List of Security Fixes and Improvements in Veeam Service Provider Console
• List of Security Fixes and Improvements in Veeam ONE
• Vulnerability Resolved in Veeam Service Provider Console 9.2.1
• Veeam Knowledge Base

Serial number:AV26-946
Date:September 21, 2026

As of September 21, 2026, MISP is affected by vulnerabilities in the following product:

• MISP
  • Prior to 2.5.47

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Strip the client id from module-result event reports
• Read only api keys can regain full role powers
• Refuse a MISP export upload whose content is a path or URL

Serial number:AV26-945
Date:September 21, 2026

As of September 17, 2026, MongoDB is affected by vulnerabilities in the following products:

• Mongoid
  • Multiple versions
• C Driver
  • Multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Security Related: Common Vulnerabilities and Exposures (CVEs)

Serial number:AV26-944
Date:September 21, 2026

As of September 18, 2026, Exim is affected by vulnerabilities in the following product:

• Exim
  • Prior to 4.100.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Exim Security Release - 4.100.1
• Exim Internet Mailer