Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
CERT Polska · Warning ·
MikroTrick: technical analysis, disclosure process, and the use of LLM agents
MikroTik patches vulnerabilities in RouterOS.
CERT Polska reported vulnerabilities to MikroTik, which released patches for RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. The patches fixed CVE-2026-86060 and CVE-2026-67279, which allowed an attacker to obtain full administrative privileges without authentication. The vulnerabilities were likely being exploited before the patches were released.
Recommended by the publisher: Install a patched version of RouterOS as soon as possible.
Vulnerabilities in WNC T-Mobile 5G Box IDU routers
WNC T-Mobile 5G Box IDU routers have vulnerabilities.
WNC T-Mobile 5G Box IDU routers with firmware before 1.1.0.651412 have authentication bypass, command injection, and CSRF vulnerabilities. An attacker can bypass authentication or execute arbitrary commands. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: Update to firmware version 1.1.0.651412.
Vulnerabilities in Alior Bank "raty" module for PrestaShop
Alior Bank's raty module has SQL injection vulnerabilities.
The vulnerabilities affect versions 8.0.0 to 8.1.11 and 8.1.9 to 8.1.12. An attacker can inject arbitrary SQL, potentially allowing unauthorized access to database contents. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: Update to fixed versions 9.0.7, 9.0.8, 8.1.11 or 8.1.12.
CVE-2026-17038 affects drEryk Gabinet before 11.5.0. The vulnerability uses hard-coded API credentials. An attacker can perform privileged operations. CERT Polska received the report.
Recommended by the publisher: Update to version 11.5.0 or later.
CERT Polska found vulnerabilities in Mikrotik RouterOS software. Vulnerable versions include 7.24 below 7.24.2 and 7.9 below 7.23.4. An attacker can forge signatures or gain unauthorized access.
Recommended by the publisher: Update to version 6.49.21, 7.23.4 or 7.24.2.
Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended
MikroTik RouterOS vulnerabilities are being exploited.
CERT Polska identified six vulnerabilities in MikroTik RouterOS, including CVE-2026-67276 and CVE-2026-86060. MikroTik has released fixes in versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21. Attacks are exploiting these vulnerabilities to take control of devices.
Recommended by the publisher: Update RouterOS immediately to a version containing the complete fixes and check the configuration for unknown users and changes.
Vulnerability in OptimiDoc Server (On-Premise) software
OptimiDoc Server On-Premise has a password storage vulnerability.
CVE-2026-15933 affects OptimiDoc Server versions before 26.08. An authenticated administrator can view credentials in cleartext. This issue was fixed in version 26.08.
Recommended by the publisher: CERT Polska recommends updating to version 26.08.
Dool software has vulnerabilities, concerns users of versions up to 1.3.8.
CVE-2026-56651 and CVE-2026-56652 affect dool versions up to 1.3.8. A local attacker can exploit these vulnerabilities to overwrite sensitive files or inject malicious formulas into CSV output. CERT Polska has received a report about these vulnerabilities. The issues were addressed by pull requests #116 and #117.
Recommended by the publisher: CERT Polska recommends updating dool to a version where these issues are fixed.
GNU wget versions through 1.25.0 are vulnerable to denial of service in FTP OPIE/S-KEY authentication. A malicious FTP server can cause wget to perform excessive MD5 computations. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa.
Recommended by the publisher: Update wget to a version after 1.25.0.
KAON PG5298A and PG5298B routers have Incorrect Authorization and Missing Authentication vulnerabilities. Firmware in these routers allows users to perform unauthorized operations. These vulnerabilities have been fixed in firmware versions 3.0.82 and 4.0.82.
Recommended by the publisher: Update to firmware version 3.0.82 for PG5298A and 4.0.82 for PG5298B.
ATutor 2.2.4 is vulnerable to remote code execution, authentication bypass, and cross-site request forgery. An attacker can upload malicious scripts, authenticate as an existing user, or modify profile fields. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: CERT Polska recommends updating ATutor software.
CVE-2026-65609, CVE-2026-65610, CVE-2026-65611 and CVE-2026-65612 affect nnn software version 5.2. An attacker can exploit these to corrupt memory or execute shell commands. The maintainer of nnn was notified.
Recommended by the publisher: CERT Polska recommends checking with the maintainer for patched versions.
Carbone software vulnerability affects versions before 3.8.2.
Carbone software is vulnerable to Denial of Service due to improper handling of highly compressed data. An attacker can supply a malicious .docx file containing a zip bomb. The issue was fixed in versions 3.8.2, 4.26.3 and 5.4.4.
Recommended by the publisher: Update to a fixed version.
Vulnerability in OutSystems Service Center software
OutSystems Service Center has XSS vulnerability.
OutSystems Service Center versions before 11.41.2 are vulnerable to DOM-based Cross-Site Scripting. A low-privileged attacker can exploit this via a malicious filename. The issue was fixed in version 11.41.2.
Recommended by the publisher: Update to OutSystems Service Center version 11.41.2.