CVE-2026-10068

Name of the Vulnerable Software and Affected Versions Shibby Tomato version 1.28

Description A flaw in the SUBSCRIBE Call Handler component allows for server-side request forgery, a condition where an attacker can induce the server to make requests to an unintended location. The issue is located in the send() function within the usr/sbin/miniupnpd file and can be triggered remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.