CVE-2026-118607: Improper Neutralization of Special Elements used in an OS Command

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities stem from a lack of consistent restrictions when deserializing object types marked for storing configuration in an independent top-level configuration file. This may all...

CVE-2026-116778: Improper Neutralization of Special Elements used in an OS Command

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CrashFTP cross-site request forgery vulnerability

Versions of CrushFTP prior to 7.3.0 contain a cross-site request forgery vulnerability. This flaw arises because CSRF protection is disabled by default. Attackers can trick authenticated administrators into visiting malicious pages and submitting POST requests to commands such as setUserItem,...

CVE-2026-86400: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

CVE-2026-118606: Exposed Dangerous Method or Function

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The...

CVE-2026-118603: Stack-based Buffer Overflow

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

PT-2026-128312

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.587 Jenkins LTS versions prior to 2.580.1 Description An issue exists where the software does not consistently enforce restrictions on deserializing objects of types that store their configuration in independent...

Sophos SG UTM path traversal vulnerability

Sophos SG UTM versions 9.724 and earlier contain a path traversal vulnerability. This vulnerability arises from path traversal; when the mail proxy is enabled for scanning, remote unauthenticated attackers can gain a race condition by repeatedly launching attacks over several minutes, potentially...

PT-2026-128325

Name of the Vulnerable Software and Affected Versions Alpine iLX-F511 affected versions not specified Description An issue exists in the Android Auto service where the system fails to properly validate the length of user-supplied data before copying it into a fixed-length stack-based buffer. This...

Linux Kernel Missing Initialization of a Variable Vulnerability

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place...

Rocky Linux 10.2 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_89849)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689849 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary...

PT-2026-128326

Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this...

PT-2026-128321

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The...

FOG Project FOG command injection vulnerability

Versions prior to FOG 1.5.10.2253 and versions prior to 1.6.0-RC-1 contain a security vulnerability. This vulnerability stems from API validation of credentials without enforcing administrator roles. Low-privilege authenticated users with API access can modify the user, pass, and ftppath fields o...

CVE-2026-103409: Juniper Networks Session Smart Router: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an…

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can on...

CVE-2026-103401: Juniper Networks: An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server…

An Improper Link Resolution Before File Access 'Link Following' vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. Th...

PT-2026-128277

An Improper Link Resolution Before File Access 'Link Following' vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. Th...

Alpine iLX-F511 permission and access control vulnerability

The Alpine iLX-F511 version 7.0.000 contains a vulnerability related to permission escalation and access control. This vulnerability stems from a dangerous method exposed in the Fiv service, which may allow local attackers to escalate their privileges to root and execute arbitrary code...

Alpine iLX-F511 permission and access control vulnerability

The Alpine iLX-F511 version 7.0.000 contains a vulnerability related to permission escalation and access control. This issue stems from a dangerous function exposed in the framework service, which may allow network-neighboring attackers to execute arbitrary code with root privileges without...