Flatpak

Mentions · 7d0
Mentions · 30d1
All mentions4
First seenSep 10, 2026
Last mentioned23d ago

Timeline

4 articles · newest first

Essay defends Flatpak sandbox against claims it is insecure

The author says statically permissioned Flathub apps reflect insecure applications and immature portals, not a failed sandbox.

Lobsters · securityOct 19, 04:02 UTC · 23d agoIndustry1 · 1 read

Re: Flatpak 1.18.1 fixes multiple vulnerabilities

MITRE assigned CVE-2026-96808 and CVE-2026-96807 to Flatpak flaws fixed in 1.18.1.

oss-securitySep 23, 18:35 UTC · Sep 23, 2026VulnerabilityCVE-2026-96807 CVE-2026-968083 · 2 reads

USN-8779-2: Bubblewrap regression

Ubuntu issued USN-8779-2 reverting a Bubblewrap symlink fix for CVE-2026-87766 that caused a regression preventing some Flatpak apps from launching.

Ubuntu Security NoticesSep 17, 22:20 UTC · Sep 17, 2026AdvisoryCVE-2026-87766 CVE-2019-124391 · 1 read

USN-8741-1: Flatpak vulnerabilities

Ubuntu patched two Flatpak flaws, including a sandbox escape via app-controlled symlinks allowing host code execution (CVE-2026-34078).

Ubuntu Security NoticesSep 10, 08:44 UTC · Sep 10, 2026AdvisoryCVE-2026-34078 CVE-2026-340792 · 1 read

Related CVEs

by mentions

CVE-2026-340782%9.3
Flatpak: The Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths…
published Apr 7, 2026flatpak flatpak
CVE-2026-87766<1%8.8
Symlink-following sandbox escape (arbitrary file write) in bubblewrap before 0.12.0
published Sep 9, 2026bubblewrap project (freedesktop.org) bubblewrap
CVE-2026-34079<1%8.7
Flatpak: The caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache…
published Apr 7, 2026flatpak flatpak
CVE-2019-12439<1%7.8
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point
published May 29, 2019projectatomic bubblewrap
CVE-2026-968087.4
Symlink traversal in Flatpak revokefs allows local root privilege escalation
published Sep 23, 2026Flatpak project (freedesktop.org) Flatpak (revokefs writer / flatpak-system-helper)
CVE-2026-968074.0
Symlink-based arbitrary file write in Flatpak ld cache regeneration (fixed in 1.18.1)
published Sep 23, 2026Flatpak (freedesktop.org) Flatpak

Appears with

Ubuntuvendor · 2
Flatpakvendor · 1
MITREorganization · 1
Canonicalvendor · 1
PrismLauncherproduct · 1
Ubuntuorganization · 1
Bubblewrapproduct · 1
Flathuborganization · 1
fractureisermalware · 1

Entities are extracted by the model from each article. First seen Sep 10, 2026, last mentioned 23d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.