#flatpak

0 stories this week · 1 this month · 7 in 6 months · mostly security

Stories per day · 30 days

7 stories, newest first · one card per story

The author says statically permissioned Flathub apps reflect insecure applications and immature portals, not a failed sandbox.

Flatpak 1.18.4 fixes multiple security vulnerabilities and hardens against symlink traversal issues tracked as CVE-2026-97023 and CVE-2026-97024.

MITRE assigned CVE-2026-96808 and CVE-2026-96807 to Flatpak flaws fixed in 1.18.1.

oss-securitySep 23, 2026high

xdg-dbus-proxy 0.1.9 patches sandbox escape CVE-2026-94422; every older release is vulnerable.

Simon McVittie disclosed CVE identifiers for multiple vulnerabilities fixed in Flatpak 1.18.1, with two IDs still pending from MITRE.

Ubuntu issued USN-8779-2 reverting a Bubblewrap symlink fix for CVE-2026-87766 that caused a regression preventing some Flatpak apps from launching.

Ubuntu patched two Flatpak flaws, including a sandbox escape via app-controlled symlinks allowing host code execution (CVE-2026-34078).

Stories tagged #flatpak