CERT Polska has found 6 vulnerabilities (from CVE-2026-67276 to CVE-2026-67279, CVE-2026-67281 and CVE-2026-86060) in Mikrotik RouterOS software.

The CERT Polska team has identified and coordinated the disclosure of six vulnerabilities in MikroTik RouterOS, including two critical ones. The vulnerabilities are already being actively exploited to take over devices whose SSH service is accessible from the internet. We recommend immediately updating devices to the patched versions and verifying the configuration for signs of compromise.

Plaintext Storage of a Password vulnerability (CVE-2026-15933) has been found in OptimiDoc Server (On-Premise) software.

CERT Polska has received a report about 2 vulnerabilities (CVE-2026-56651 and CVE-2026-56652) found in dool software.

Denial of Service vulnerability (CVE-2026-16599) has been found in GNU wget software.

CERT Polska has received a report about 2 vulnerabilities (CVE-2025-63080 and CVE-2026-6017) found in KAON PG5298A/PG5298B routers.

CERT Polska has received a report about 13 vulnerabilities (from CVE-2026-64960 to CVE-2026-64972) found in ATutor software.

CERT Polska has received a report about 4 vulnerabilities (from CVE-2026-65609 to CVE-2026-65612) found in nnn software.

Improper handling of highly compressed data (data amplification) vulnerability (CVE-2026-18929) has been found in Carbone software.

DOM-based Cross-site Scripting vulnerability (CVE-2026-40126) has been found in OutSystems Service Center software.