Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-41875) has been found in Quick.Cart software.

External control of file name or path vulnerability (CVE-2026-85520) has been found in MyPresta Google Merchant Center Feed software.

Untrusted Search Path vulnerability (CVE-2026-19547) has been found in Ghostscript software.

Out-of-bounds write vulnerability (CVE-2026-15390) has been found in DENX Software Engineering Das U-Boot software.

CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-73640 to CVE-2026-73642) found in Dayforce ESS Excelity software.

CERT Polska has received a report about 2 vulnerabilities (CVE-2026-52748 and CVE-2026-52749) found in Kaon AR2140 routers.

CERT Polska has received a report about 7 vulnerabilities (from CVE-2026-82928 to CVE-2026-82930 and CVE-2026-82932, CVE-2026-82933, CVE-2026-82935 and CVE-2026-82936) found in F&F Filipowski mH-DEVELOPER devices.

Authorization bypass through User-Controlled key vulnerability (CVE-2026-92419) has been found in WEBCON BPS software.

We describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in the wild, the coordinated disclosure of both vulnerabilities, and the practical role of LLM agents in the RouterOS research.

CERT Polska has received a report about 6 vulnerabilities (CVE-2026-58146, CVE-2026-58147 and from CVE-2026-40854 to CVE-2026-40857) found in firmware of WNC T-Mobile 5G Box IDU routers.