I Dont know if Tomato publishes CVEs. But you could check the release notes for OpenWrt for CVEs over the last couple of years. I would trust OpenWrt more, esp

I Dont know if Tomato publishes CVEs. But you could check the release notes for OpenWrt for CVEs over the last couple of years. I would trust OpenWrt more, especially their continued support for old devices, one accesspoint of mine is 11 years old, supported in the 2022 release and still going strong (128MB RAM, 32MB flash)