# Netcore vulnerabilities Source: https://junglewise.ai/threats/vendors/netcore Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/netcore.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 56 vulnerabilities in Netcore: 0 in the last 7 days and 56 in the last 90 days, 19 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121382, was published on 3 November 2026. 11 vulnerabilities in the last four weeks, down 76% on the four before (45). 3 critical against 16. 5 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 5 - Last 90 days: 56 - All time: 56 (19 critical, 0 exploited in the wild) ## About Netcore Technology company focused on messaging and communication solutions. ## Latest Netcore vulnerabilities - [CVE-2026-121382: Netcore NBR100V2 integer overflow in AES decryption](https://junglewise.ai/threats/cve-2026-121382-a-vulnerability-was-determined-in-netcore-nbr100v2-1-3-240614) (high, CVSS 7.5, published 3 Nov 2026) - [CVE-2026-112016: Netcore NR256CN unauthenticated file write in Boa web server](https://junglewise.ai/threats/cve-2026-112016-netcore-nr256cn-through-1-5-140116-contains-an-unauthenticated) (medium, CVSS 6.5, published 18 Oct 2026) - [CVE-2026-111712: Netcore NR256CN authentication bypass via CGI path prefix](https://junglewise.ai/threats/cve-2026-111712-netcore-nr256cn-through-1-5-140116-contains-an-authentication) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-111711: Netcore NR256CN stack overflow in Boa web server user authentication](https://junglewise.ai/threats/cve-2026-111711-netcore-nr256cn-through-1-5-140116-contains-a-pre-authentication) (critical, CVSS 9.8, published 16 Oct 2026) - [CVE-2026-111710: Netcore NR256CN NULL pointer dereference in Boa web server](https://junglewise.ai/threats/cve-2026-111710-netcore-nr256cn-through-1-5-140116-contains-a-null-pointer) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-108932: Netcore NR268 stored XSS in DHCP Hostname Handler](https://junglewise.ai/threats/cve-2026-108932-a-vulnerability-was-determined-in-netcore-nr268-1-7-121109-this) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-108931: Netcore NR268 stored cross-site scripting in DHCP handler](https://junglewise.ai/threats/cve-2026-108931-a-vulnerability-was-found-in-netcore-nr268-1-7-121109-this) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-108929: Netcore NR268 DDNS argument injection](https://junglewise.ai/threats/cve-2026-108929-a-flaw-has-been-found-in-netcore-nr268-1-7-121109-the-affected) (critical, CVSS 9.9, published 12 Oct 2026) - [CVE-2026-108909: Netcore NR268 cross-site request forgery in CGI endpoint](https://junglewise.ai/threats/cve-2026-108909-a-security-flaw-has-been-discovered-in-netcore-nr268-1-7-121109) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-108907: Netcore NR268 authentication bypass in CGI execution](https://junglewise.ai/threats/cve-2026-108907-a-vulnerability-was-determined-in-netcore-nr268-1-7-121109) (critical, CVSS 10, published 12 Oct 2026) - [CVE-2026-108906: Netcore NR268 out-of-bounds read in ARP filter upload](https://junglewise.ai/threats/cve-2026-108906-a-vulnerability-has-been-found-in-netcore-nr268-1-7-121109-this) (high, CVSS 7.2, published 12 Oct 2026) - [CVE-2026-78796: Netcore B6/B11/NBR100 router unauthenticated remote code execution](https://junglewise.ai/threats/cve-2026-78796-an-issue-in-netcore-b11-enterprise-level-full-gigabit-9-port-shop) (info, published 9 Oct 2026) - [CVE-2026-78795: Netcore B11 router information disclosure vulnerability](https://junglewise.ai/threats/cve-2026-78795-an-issue-in-netcore-b11-enterprise-level-full-gigabit-9-port-shop) (high, CVSS 7.5, published 9 Oct 2026) - [CVE-2026-102240: Netcore NAP930 OS command injection in network tools CGI](https://junglewise.ai/threats/cve-2026-102240-a-vulnerability-was-found-in-netcore-nap930-0-1-241010-141410) (critical, CVSS 10, published 29 Sep 2026) - [CVE-2026-101188: Netcore POWER13 unauthenticated password reset in routerd](https://junglewise.ai/threats/cve-2026-101188-a-security-vulnerability-has-been-detected-in-netcore-power13-2) (high, CVSS 8.3, published 28 Sep 2026) - [CVE-2026-101077: Netcore NR289-GE authentication bypass in boa web server](https://junglewise.ai/threats/cve-2026-101077-a-flaw-has-been-found-in-netcore-nr289-ge-1-4-5102-this-impacts) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101076: Netcore NR289-GE OS command injection in NTP handler](https://junglewise.ai/threats/cve-2026-101076-a-vulnerability-was-detected-in-netcore-nr289-ge-1-4-5102-this) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101075: Netcore NR289-GE OS command injection in location_time.cgi](https://junglewise.ai/threats/cve-2026-101075-a-security-vulnerability-has-been-detected-in-netcore-nr289-ge-1) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101074: Netcore NR289-GE stack buffer overflow in boa](https://junglewise.ai/threats/cve-2026-101074-a-weakness-has-been-identified-in-netcore-nr289-ge-1-4-5102-the) (critical, CVSS 9.8, published 28 Sep 2026) - [CVE-2026-101073: Netcore NR289-GE authentication bypass in CGI dispatcher](https://junglewise.ai/threats/cve-2026-101073-a-security-flaw-has-been-discovered-in-netcore-nr289-ge-1-4-5102) (high, CVSS 8.3, published 28 Sep 2026) - [CVE-2026-101072: Netcore NR289-GE OS command injection in CGI handler](https://junglewise.ai/threats/cve-2026-101072-a-vulnerability-was-identified-in-netcore-nr289-ge-1-4-5102-this) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101002: Netcore NBR200V2 authenticated command injection in Tools Ping](https://junglewise.ai/threats/cve-2026-101002-a-security-flaw-has-been-discovered-in-netcore-nbr200v2-1-3) (critical, CVSS 9.9, published 28 Sep 2026) - [CVE-2026-101001: Netcore NBR200V2 command injection in network_tools](https://junglewise.ai/threats/cve-2026-101001-a-vulnerability-was-identified-in-netcore-nbr200v2-1-3-241127) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101000: Netcore NBR100V2 missing authorization in ACL handler](https://junglewise.ai/threats/cve-2026-101000-a-vulnerability-was-determined-in-netcore-nbr100v2-1-3-240614) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-94101: Netcore NBR200V2 buffer overflow in routerd VLAN handler](https://junglewise.ai/threats/cve-2026-94101-a-security-vulnerability-has-been-detected-in-netcore-nbr200v2-1) (critical, CVSS 9.9, published 21 Sep 2026) ## Most severe Netcore vulnerabilities - [CVE-2026-94097: Netcore NBR200V2 command injection in network tools CGI](https://junglewise.ai/threats/cve-2026-94097-a-vulnerability-was-determined-in-netcore-nbr200v2-1-3-241127) (critical, CVSS 10, published 21 Sep 2026) - [CVE-2026-108907: Netcore NR268 authentication bypass in CGI execution](https://junglewise.ai/threats/cve-2026-108907-a-vulnerability-was-determined-in-netcore-nr268-1-7-121109) (critical, CVSS 10, published 12 Oct 2026) - [CVE-2026-102240: Netcore NAP930 OS command injection in network tools CGI](https://junglewise.ai/threats/cve-2026-102240-a-vulnerability-was-found-in-netcore-nap930-0-1-241010-141410) (critical, CVSS 10, published 29 Sep 2026) - [CVE-2026-101077: Netcore NR289-GE authentication bypass in boa web server](https://junglewise.ai/threats/cve-2026-101077-a-flaw-has-been-found-in-netcore-nr289-ge-1-4-5102-this-impacts) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101076: Netcore NR289-GE OS command injection in NTP handler](https://junglewise.ai/threats/cve-2026-101076-a-vulnerability-was-detected-in-netcore-nr289-ge-1-4-5102-this) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101075: Netcore NR289-GE OS command injection in location_time.cgi](https://junglewise.ai/threats/cve-2026-101075-a-security-vulnerability-has-been-detected-in-netcore-nr289-ge-1) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101072: Netcore NR289-GE OS command injection in CGI handler](https://junglewise.ai/threats/cve-2026-101072-a-vulnerability-was-identified-in-netcore-nr289-ge-1-4-5102-this) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101001: Netcore NBR200V2 command injection in network_tools](https://junglewise.ai/threats/cve-2026-101001-a-vulnerability-was-identified-in-netcore-nbr200v2-1-3-241127) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-101000: Netcore NBR100V2 missing authorization in ACL handler](https://junglewise.ai/threats/cve-2026-101000-a-vulnerability-was-determined-in-netcore-nbr100v2-1-3-240614) (critical, CVSS 10, published 28 Sep 2026) - [CVE-2026-94095: Netcore NBR200V2 command injection in traceroute diagnostic](https://junglewise.ai/threats/cve-2026-94095-a-vulnerability-has-been-found-in-netcore-nbr200v2-1-3-241127) (critical, CVSS 9.9, published 21 Sep 2026) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, down 76% on the four before (45). 3 critical against 16. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 25 | 0 | 0 | | 21 Sep 2026 | 7 | 7 | 0 | | 28 Sep 2026 | 11 | 9 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 10 | 3 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Netcore technologies - [Netcore NR255-V](https://junglewise.ai/threats/technologies/nr255-v): 23 vulnerabilities - [Netcore NBR200V2](https://junglewise.ai/threats/technologies/nbr200v2): 9 vulnerabilities - [Netcore NR268](https://junglewise.ai/threats/technologies/nr268): 8 vulnerabilities - [Netcore NR289-GE](https://junglewise.ai/threats/technologies/nr289-ge): 6 vulnerabilities - [Netcore NR256CN](https://junglewise.ai/threats/technologies/nr256cn): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Netcore vulnerabilities", https://junglewise.ai/threats/vendors/netcore, 12 November 2026.