https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-37532.htmlhttps://patchthecve.com/cve/CVE-2026-37532.htmlWed, 17 Jun 2026 10:41:34 +0000HIGH 7.1: AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive (receive.c:87-89), the payload_length for a Single Frame is extracted from a 4-bit nibble in the CAN frame data, yielding values 0-15. However, a standard CAN frame is only 8https://patchthecve.com/cve/CVE-2026-37531.htmlhttps://patchthecve.com/cve/CVE-2026-37531.htmlWed, 17 Jun 2026 10:41:34 +0000CRITICAL 9.8: AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367) in the widget installation flow. The is_valid_filename function in wgtpkg-zip.c validates ZIP entry names but does not check for dot notation directory traverhttps://patchthecve.com/cve/CVE-2026-37530.htmlhttps://patchthecve.com/cve/CVE-2026-37530.htmlWed, 17 Jun 2026 10:41:33 +0000HIGH 7.5: AGL agl-service-can-low-level thru 17.1.12 contains a stack buffer overflow in the uds-c library. The send_diagnostic_request function in uds.c allocates a 6-byte stack buffer (MAX_DIAGNOSTIC_PAYLOAD_SIZE=6) but copies up to 7 bytes (MAX_UDS_REQUEST_PAYLOAD_LENGTH=7) via memcpy at an offset of 1+pidhttps://patchthecve.com/cve/CVE-2026-37526.htmlhttps://patchthecve.com/cve/CVE-2026-37526.htmlWed, 17 Jun 2026 10:41:33 +0000HIGH 7.8: AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The on_supervision_call function in shttps://patchthecve.com/cve/CVE-2026-37525.htmlhttps://patchthecve.com/cve/CVE-2026-37525.htmlWed, 17 Jun 2026 10:41:33 +0000HIGH 7.8: AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before d