Flatpak (Vendor): news timeline & CVEs

Re: Flatpak 1.18.1 fixes multiple vulnerabilities

MITRE assigned CVE-2026-96808 and CVE-2026-96807 to Flatpak flaws fixed in 1.18.1.

Simon McVittie reported on oss-security that MITRE assigned CVE identifiers for two Flatpak issues fixed in version 1.18.1. CVE-2026-96808 corresponds to GHSA-qrwq-7qwx-q9rp, and CVE-2026-96807 corresponds to GHSA-99wv-m8rp-g58x. The note does not describe impact or exploitation.

oss-securitySep 23, 18:35 UTC · 3d agoVulnerability 2 sources CVE-2026-96807 CVE-2026-96808

xdg-dbus-proxy 0.1.9 fixes sandbox escape CVE-2026-94422

xdg-dbus-proxy 0.1.9 patches sandbox escape CVE-2026-94422; every older release is vulnerable.

Simon McVittie announced on oss-security that xdg-dbus-proxy 0.1.9 fixes CVE-2026-94422, a sandbox escape. All versions older than 0.1.9 are vulnerable. The fix is documented in GitHub advisory GHSA-2cgv-pwcq-wvpq and the 0.1.9 release notes. The notice does not report active exploitation.

oss-securitySep 23, 15:10 UTC · 3d agoVulnerability 2 sources CVE-2026-94422

Flatpak

Timeline2 articles

Related CVEsby mentions

Appears with

Re: Flatpak 1.18.1 fixes multiple vulnerabilities

xdg-dbus-proxy 0.1.9 fixes sandbox escape CVE-2026-94422