CERT Polska has received a report about 2 vulnerabilities (CVE-2025-63080 and CVE-2026-6017) found in KAON PG5298A/PG5298B routers.

CERT Polska has received a report about 13 vulnerabilities (from CVE-2026-64960 to CVE-2026-64972) found in ATutor software.

CERT Polska has received a report about 4 vulnerabilities (from CVE-2026-65609 to CVE-2026-65612) found in nnn software.

Improper handling of highly compressed data (data amplification) vulnerability (CVE-2026-18929) has been found in Carbone software.

DOM-based Cross-site Scripting vulnerability (CVE-2026-40126) has been found in OutSystems Service Center software.

Stored Cross-Site Scripting vulnerability (CVE-2026-18478) has been found in Magnolia CMS software.

Heap-based buffer overflow vulnerability (CVE-2026-18370) has been found in eradman entr software.

CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-66484 to CVE-2026-66486) found in GNU cpio software.

CERT Polska has received a report about 4 vulnerabilities (from CVE-2026-71391 to CVE-2026-71394) found in GNU Emacs software.

During the attacks against Poland's energy sector in late 2025, a second combined heat and power plant was also affected. We are publishing a report detailing an investigation that lasted more than three months and led to the discovery of a previously unobserved attack vector involving a private APN.