Tomato
24 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Tomato, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Tomato CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 6 |
| 2026-06 | 4 |
| 2026-07 | 8 |
| 2026-08 | 3 |
| 2026-09 | 0 |
Severity
How the 24 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High20
- Medium3
Latest CVEs
The 15 most recently published vulnerabilities affecting Tomato.
- CVE-2026-19036Shibby Tomato wanoptions sub_40F88C os command injection7.2
- CVE-2026-19035Shibby Tomato qoslimit new_qoslimit_start os command injection7.2
- CVE-2026-19034Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection7.2
- CVE-2026-16097Shibby Tomato Scheduler Name sub_42537C stack-based overflow8.8
- CVE-2026-16096Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflow8.8
- CVE-2026-16095Shibby Tomato rc setup_conntrack out-of-bounds write8.8
- CVE-2026-15548Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow8.8
- CVE-2026-15547Shibby Tomato CIFS Mount sub_2D048 os command injection6.3
- CVE-2026-15546Shibby Tomato start_jffs2 sub_2D568 os command injection6.3
- CVE-2026-15545Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write8.8
- CVE-2026-15544Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow8.8
- CVE-2026-10873Shibby Tomato Web UI rstats rstats_path os command injection7.2
- CVE-2026-10872Shibby Tomato Web UI rc start_vpnserver os command injection7.2
- CVE-2026-10871Shibby Tomato Web UI rc start_6rd_tunnel os command injection7.2
- CVE-2026-10870Shibby Tomato Web UI rc start_dhcpc os command injection7.2
Product grouping is registry-driven, with AI assist and human review. How it works