Rocky Linux 8 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_89859)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689859 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary wri...

Amazon Linux 2 : ca-certificates (ALAS-2026-4045)

The version of ca-certificates installed on the remote host is prior to 2025.2.76-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4045 advisory. The system certificate authority CA store in Amazon Linux, distributed via the ca-certificates RPM package, included...

(0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto service. The issue results from the lack of proper...

(0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from the lack of proper...

(0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from an exposed dangerous...

(0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp component. The issue results from the lack of proper...

(0Day) (Pwn2Own) Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Fiv service. The...

Alpine iLX-F511 buffer error vulnerability

The Alpine iLX-F511 version 7.0.000 contains a buffer error vulnerability. This vulnerability arises because the framework service fails to properly validate the length of user-provided data before copying it into a fixed-size stack buffer. As a result, attackers who can physically access the...

Juniper Networks Session Smart Router command injection vulnerability

A command injection vulnerability exists in Juniper Networks Session Smart Router and Session Smart Conductor versions prior to 7.0.5, from 7.1.0 up to versions prior to 7.1.7, and from 7.2.0 up to versions prior to 7.2.3. This vulnerability stems from improper handling of special elements within...

Juniper Networks Session Smart Conductor command injection vulnerability

Versions prior to Juniper Networks Session Smart Conductor 7.0.5, versions 7.1.x prior to 7.1.7, and versions 7.2.x prior to 7.2.3 contain a command injection vulnerability. This vulnerability arises from improper handling of special elements within OS commands by AutomatedProvisioner; remote...

Alpine iLX-F511 buffer error vulnerability

The Alpine iLX-F511 running version 7.0.000 contains a buffer error vulnerability. This vulnerability arises because the prhsdpservicesearchdecode function fails to properly validate the length of user-supplied data prior to copying it into the stack buffer. As a result, network-adjacent attacker...

Alpine iLX-F511 command injection vulnerability

The Alpine iLX-F511 running version 7.0.000 contains a command injection vulnerability. This flaw arises because the diagapp component executes system calls without properly validating user-supplied strings, potentially allowing attackers with physical access to execute arbitrary code as root...

Alpine iLX-F511 buffer error vulnerability

The Alpine iLX-F511 running version 7.0.000 contains a buffer error vulnerability. This flaw arises because the Android Auto connection handler fails to properly validate the length of user-supplied data prior to copying it into a fixed-length stack buffer. As a result, attackers with physical...

PT-2026-128231

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner...

PT-2026-128324

Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this...

PT-2026-128317

Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target syste...

PT-2026-128320

Alpine iLX-F511 prh sdp service search decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a...

PT-2026-128322

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp...

PT-2026-128319

Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. T...

CVE-2026-105420: Wing Soft Technology Wing FTP Server: Wing FTP Server does not verify user's base folder

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner...