Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
CERT Polska · Warning ·
Vulnerabilities in boneIO products
boneIO products have vulnerabilities.
CERT Polska reports vulnerabilities in boneIO products, including missing authentication and cleartext storage of sensitive information. Vulnerable versions range from 1.0.0 to 1.6.0. An attacker can deploy malicious flows or gain full control over devices. Issues were fixed in version 1.6.0.
Recommended by the publisher: Update to version 1.6.0.
CGM CLININET versions before 2026.MS3 are vulnerable to Missing Authentication for Critical Function and Deserialization of Untrusted Data. An attacker can retrieve patient documents and execute arbitrary code with root privileges. CGM has fixed these issues in version 2026.MS3.
Recommended by the publisher: Update to version 2026.MS3 or later.
CVE-2026-16477 affects CleanShot X versions 4.0.0 to 4.5.2. An attacker can execute arbitrary code via a malicious .cleanshot file. Exploitation requires the target to open the file. The vulnerability was fixed in versions 4.5.2, 4.6.3, 4.7.8 and 4.8.10.
Recommended by the publisher: Update to a fixed version.
NordVPN software vulnerability affects Windows users.
NordVPN for Windows versions before 8.12 are vulnerable to Incorrect Authorization. A local attacker can stop unprotected Windows system services. The issue was fixed in version 8.12. CERT Polska received the vulnerability report.
Recommended by the publisher: Update NordVPN to version 8.12.
Vulnerability in Sparx Systems Enterprise Architect software
Enterprise Architect has XXE vulnerability.
Sparx Systems Enterprise Architect version 17.1 is vulnerable to XML External Entity injection. An attacker can read arbitrary files from the victim's filesystem. The vulnerability may also affect other versions.
Recommended by the publisher: CERT Polska recommends updating Enterprise Architect.
Slican telephone exchanges have vulnerabilities, affecting IPx, CCT-1668, MAC-6400, CXS-0424.
CERT Polska has received a report about vulnerabilities in Slican telephone exchanges. The vulnerabilities are Inadequate Encryption Strength, SQL Injection and Plaintext storage of a password. Slican IPx series version 6.62.0100 fixes these issues. CCT-1668, MAC-6400, CXS-0424 will not receive updates.
Recommended by the publisher: The vendor recommends that users of End-Of-Life devices contact their service department to determine upgrade options.
Ollama software vulnerability affects versions 0.34.2 to 0.35.0.
CVE-2026-103663 is a Relative Path Traversal vulnerability in Ollama software. An unauthenticated remote attacker can write a malicious binary outside the model store. CERT Polska has received a report about this vulnerability. The issue was fixed in version 0.35.0.
Recommended by the publisher: Update to version 0.35.0 or later.
GNU Aspell software has vulnerabilities, affecting versions before 0.60.8.3.
CVE-2026-75818, CVE-2026-75819, and CVE-2026-75820 are heap-based buffer overflow, out-of-bounds read, and integer overflow vulnerabilities. An attacker can trigger memory corruption or denial of service via crafted files. These issues were fixed in version 0.60.8.3.
Recommended by the publisher: Update to version 0.60.8.3 to fix vulnerabilities.
gotop software has argument injection vulnerability.
CVE-2026-91784 affects gotop version 3.0.0. A local attacker can terminate processes owned by a targeted user. The product is no longer supported and the vulnerability has not been fixed. CERT Polska has confirmed the vulnerability at version 3.0.0.
Recommended by the publisher: No recommendation is given.
Quick.Cart software has a Cross-Site Request Forgery vulnerability.
CERT Polska has received a report about vulnerability CVE-2026-41875 in Quick.Cart software. The vulnerability allows an attacker to change admin's login and password. All versions through 6.7.0 are vulnerable. This issue was fixed in a patch to version 6.7.
Recommended by the publisher: Deploy the patch to version 6.7 to fix the issue.
Vulnerability in MyPresta Google Merchant Center Feed software
MyPresta Google Merchant Center Feed has vulnerability.
MyPresta Google Merchant Center Feed versions 1.9.1 through 2.3.8 are vulnerable to unauthenticated arbitrary file write. An attacker can execute arbitrary PHP code. This issue was fixed in version 2.3.9.
Recommended by the publisher: Update to version 2.3.9.
CVE-2026-19547 affects Ghostscript for Windows before version 10.08.0. An attacker can escalate privileges through PostScript resource file hijacking. The vulnerability allows arbitrary code execution with Ghostscript process privileges. This issue was fixed in version 10.08.0.
Recommended by the publisher: CERT Polska recommends updating to version 10.08.0.
Das U-Boot versions from 2009.08 through 2026.07 are vulnerable to out-of-bounds write. An attacker can execute arbitrary code by sending duplicated last-fragment IP packets. The issue was fixed in release version 2026.07.
Recommended by the publisher: Update to release version 2026.07.
Dayforce ESS Excelity has SQL injection and XSS vulnerabilities.
Dayforce ESS Excelity versions before V3 and V4 have SQL injection, XSS, and Path Traversal vulnerabilities. An attacker can execute arbitrary SQL queries, JavaScript, or access local files. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: Update to version V3 or V4.
Kaon AR2140 routers are vulnerable to authentication bypass.
CVE-2026-52748 and CVE-2026-52749 affect Kaon AR2140 routers through version 4.2.17. An attacker can access the backup functionality and retrieve configuration data. The attacker can also bypass authentication and perform unauthorized actions. CERT Polska has received a report about these vulnerabilities.
Recommended by the publisher: CERT Polska recommends checking the status of newer firmware versions.
Vulnerabilities in F&F Filipowski mH-DEVELOPER devices
F&F Filipowski mH-DEVELOPER devices are vulnerable.
F&F Filipowski mH-DEVELOPER devices before version 3.0.30 are affected. An attacker can gain a root shell, intercept credentials, or cause a denial of service. CERT Polska has coordinated the disclosure of these vulnerabilities.
Recommended by the publisher: CERT Polska recommends updating to version 3.0.30.
Inside a multi stage toll fraud operation targeting Poland
CERT Polska found toll fraud operation targeting Poland.
Messenger Pro app on Google Play was used for toll fraud. The app sent Polish users to premium SMS services. CERT Polska reported the app to Google. The operation used multiple layers to execute toll fraud.
Recommended by the publisher: CERT Polska recommends caution with suspicious ads and apps.