# cve.now: Netcore

The newest entries naming Netcore as an affected vendor (up to 200), of 61 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121382](https://cve.now/CVE-2026-121382.md): Netcore NBR100V2 auto\_ac msg\_aes\_dec integer overflow (CVSS 8.7)
- [CVE-2026-112016](https://cve.now/CVE-2026-112016.md): Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files (CVSS 6.9)
- [CVE-2026-111712](https://cve.now/CVE-2026-111712.md): Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix (CVSS 6.9)
- [CVE-2026-111711](https://cve.now/CVE-2026-111711.md): Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user\_ok() (CVSS 9.3)
- [CVE-2026-111710](https://cve.now/CVE-2026-111710.md): Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS (CVSS 8.7)
- [CVE-2026-108932](https://cve.now/CVE-2026-108932.md): Netcore NR268 DHCP Hostname filter\_hosts\_dump.cgi eval cross site scripting (CVSS 5.3)
- [CVE-2026-108931](https://cve.now/CVE-2026-108931.md): Netcore NR268 DHCP dhcp\_dynamicip\_show.cgi eval cross site scripting (CVSS 5.3)
- [CVE-2026-108930](https://cve.now/CVE-2026-108930.md): Netcore NR268 DDNS ddns\_wan\_list\_show.cgi ddns\_wan\_list\_show information disclosure (CVSS 5.1)
- [CVE-2026-108929](https://cve.now/CVE-2026-108929.md): Netcore NR268 DDNS DDNSset.cgi execvp argument injection (CVSS 9.4)
- [CVE-2026-108909](https://cve.now/CVE-2026-108909.md): Netcore NR268 CGI Endpoint cross-site request forgery (CVSS 5.3)
- [CVE-2026-108908](https://cve.now/CVE-2026-108908.md): Netcore NR268 Web UI l7\_call\_board\_user\_set.cgi eval cross site scripting (CVSS 4.8)
- [CVE-2026-108907](https://cve.now/CVE-2026-108907.md): Netcore NR268 CGI Execution user\_ok improper authentication (CVSS 10.0)
- [CVE-2026-108906](https://cve.now/CVE-2026-108906.md): Netcore NR268 filter\_arp\_put\_file.cgi filter\_arp\_put\_file\_cgi out-of-bounds (CVSS 8.6)
- [CVE-2026-102241](https://cve.now/CVE-2026-102241.md): Netcore NAP930 Backup/Restore backup\_common.sh hard-coded key (CVSS 5.1)
- [CVE-2026-102240](https://cve.now/CVE-2026-102240.md): Netcore NAP930 Network Tools CGI network\_tools eval os command injection (CVSS 10.0)
- [CVE-2026-101188](https://cve.now/CVE-2026-101188.md): Netcore POWER13 ubus routerd.passwd\_set password recovery (CVSS 6.9)
- [CVE-2026-101077](https://cve.now/CVE-2026-101077.md): Netcore NR289-GE boa\_temp process\_request missing authentication (CVSS 10.0)
- [CVE-2026-101076](https://cve.now/CVE-2026-101076.md): Netcore NR289-GE CGI set\_ntp\_server\_ip.cgi system os command injection (CVSS 10.0)
- [CVE-2026-101075](https://cve.now/CVE-2026-101075.md): Netcore NR289-GE Location Time location\_time.cgi system os command injection (CVSS 10.0)
- [CVE-2026-101074](https://cve.now/CVE-2026-101074.md): Netcore NR289-GE Authentication boa password-check stack-based overflow (CVSS 9.3)
- [CVE-2026-101073](https://cve.now/CVE-2026-101073.md): Netcore NR289-GE CGI Dispatcher boa improper authentication (CVSS 6.9)
- [CVE-2026-101072](https://cve.now/CVE-2026-101072.md): Netcore NR289-GE CGI ap\_ip.cgi system os command injection (CVSS 10.0)
- [CVE-2026-101002](https://cve.now/CVE-2026-101002.md): Netcore NBR200V2 Tools Ping network\_tools system os command injection (CVSS 9.4)
- [CVE-2026-101001](https://cve.now/CVE-2026-101001.md): Netcore NBR200V2 Web Management network\_tools eval os command injection (CVSS 10.0)
- [CVE-2026-101000](https://cve.now/CVE-2026-101000.md): Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization (CVSS 10.0)
- [CVE-2026-94101](https://cve.now/CVE-2026-94101.md): Netcore NBR200V2 routerd vlan\_load\_form\_uci buffer overflow (CVSS 9.4)
- [CVE-2026-94100](https://cve.now/CVE-2026-94100.md): Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan\_config\_set\_vlan buffer overflow (CVSS 9.4)
- [CVE-2026-94099](https://cve.now/CVE-2026-94099.md): Netcore NBR200V2 Backup Restore restore.cgi command injection (CVSS 9.4)
- [CVE-2026-94098](https://cve.now/CVE-2026-94098.md): Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection (CVSS 9.4)
- [CVE-2026-94097](https://cve.now/CVE-2026-94097.md): Netcore NBR200V2 CGI Diagnostic Endpoint network\_tools command injection (CVSS 10.0)
- [CVE-2026-94096](https://cve.now/CVE-2026-94096.md): Netcore NBR200V2 LAN IP Configuration network\_tools command injection (CVSS 9.4)
- [CVE-2026-94095](https://cve.now/CVE-2026-94095.md): Netcore NBR200V2 Traceroute Diagnostic Feature network\_tools command injection (CVSS 9.4)
- [CVE-2026-92257](https://cve.now/CVE-2026-92257.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks (CVSS 5.1)
- [CVE-2026-92256](https://cve.now/CVE-2026-92256.md): Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd\_config\_show.cgi Read Handlers (CVSS 7.1)
- [CVE-2026-92255](https://cve.now/CVE-2026-92255.md): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter\_arp\_put\_file.cgi via String API Misuse (CVSS 5.3)
- [CVE-2026-76873](https://cve.now/CVE-2026-76873.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields (CVSS 5.1)
- [CVE-2026-76872](https://cve.now/CVE-2026-76872.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages (CVSS 5.1)
- [CVE-2026-76871](https://cve.now/CVE-2026-76871.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers (CVSS 7.1)
- [CVE-2026-76870](https://cve.now/CVE-2026-76870.md): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd\_write Firmware Upload Validation (CVSS 7.1)
- [CVE-2026-76869](https://cve.now/CVE-2026-76869.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot\_timer\_set.cgi (CVSS 8.6)
- [CVE-2026-76868](https://cve.now/CVE-2026-76868.md): Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route\_policy\_add.cgi via Missing exit\_port (CVSS 6.9)
- [CVE-2026-76867](https://cve.now/CVE-2026-76867.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers (CVSS 5.1)
- [CVE-2026-76866](https://cve.now/CVE-2026-76866.md): Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters (CVSS 8.6)
- [CVE-2026-76865](https://cve.now/CVE-2026-76865.md): Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers (CVSS 6.9)
- [CVE-2026-76864](https://cve.now/CVE-2026-76864.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names (CVSS 4.8)
- [CVE-2026-76863](https://cve.now/CVE-2026-76863.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes (CVSS 5.3)
- [CVE-2026-76862](https://cve.now/CVE-2026-76862.md): Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths (CVSS 8.7)
- [CVE-2026-76861](https://cve.now/CVE-2026-76861.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools\_tcpdump\_start\_set.cgi (CVSS 8.7)
- [CVE-2026-76860](https://cve.now/CVE-2026-76860.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake\_up\_set.cgi via MAC and ID Tokenization (CVSS 8.7)
- [CVE-2026-76859](https://cve.now/CVE-2026-76859.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user\_pass\_show.cgi (CVSS 7.1)
- [CVE-2026-76858](https://cve.now/CVE-2026-76858.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns\_wan\_list\_show.cgi (CVSS 4.8)
- [CVE-2026-76857](https://cve.now/CVE-2026-76857.md): Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns\_wan\_list\_show.cgi (CVSS 7.1)
- [CVE-2026-76856](https://cve.now/CVE-2026-76856.md): Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints (CVSS 7.0)
- [CVE-2026-76855](https://cve.now/CVE-2026-76855.md): Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints (CVSS 7.1)
- [CVE-2026-76854](https://cve.now/CVE-2026-76854.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7\_web\_auth\_user\_show.cgi (CVSS 7.1)
- [CVE-2026-76853](https://cve.now/CVE-2026-76853.md): Netcore NR268 1.7.121109 Security Check Bypass in parame\_put\_file.cgi (CVSS 7.2)
- [CVE-2026-76852](https://cve.now/CVE-2026-76852.md): Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd\_write (CVSS 8.7)
- [CVE-2026-4840](https://cve.now/CVE-2026-4840.md): Netcore Power 15AX Diagnostic Tool netis.cgi setTools os command injection (CVSS 8.7)
- [CVE-2025-5147](https://cve.now/CVE-2025-5147.md): Netcore NBR1005GPEV2/NBR200V2/B6V2 network\_tools tools\_ping command injection (CVSS 5.3)
- [CVE-2025-5146](https://cve.now/CVE-2025-5146.md): Netcore NBR200V2 HTTP Header routerd passwd\_set command injection (CVSS 5.3)
- [CVE-2025-5145](https://cve.now/CVE-2025-5145.md): Netcore POWER13 Query String cgi-bin command injection (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/netcore
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.