FL
Product
flatpak
19
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 3High 12Medium 4Low 0
Watch
Add flatpak to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34078 | 10.0 | Apr 7 | Flatpak has a complete sandbox escape leading to host file access and code execution in the host context Affected: < 1.16.4 |
| CVE-2024-42472 | 10.0 | Aug 15 | Flatpak is a Linux application sandboxing and distribution framework Affected: 1.14.0 before 1.14.10; 1.15.0 before 1.15.10 |
| CVE-2019-10063 | 9.0 | Mar 26 | Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass Affected: before 1.0.8; 1.1.0 through 1.1.3; 1.2.0 before 1.2.4; 1.3.0 |
| CVE-2021-21261 | 8.8 | Jan 14 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux Affected: 0.11.4 before 1.8.5; 1.9.1 before 1.10.0 |
| CVE-2018-6560 | 8.8 | Feb 2 | In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because… Affected: before 0.8.9; 0.9.1 through 0.9.99; 0.10.0 before 0.10.3 |
| CVE-2021-43860 | 8.6 | Jan 12 | Flatpak is a Linux application sandboxing and distribution framework Affected: before 1.10.6; 1.11.1 through 1.12.3 |
| CVE-2024-32462 | 8.4 | Apr 18 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux Affected: before 1.10.9; 1.12.0 before 1.12.9; 1.14.0 before 1.14.6; 1.15.0 before 1.15.8 |
| CVE-2021-21381 | 8.2 | Mar 11 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux Affected: 0.9.4 before 1.10.2 |
| CVE-2019-8308 | 8.2 | Feb 12 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file Affected: before 1.0.7; 1.1.0 through 1.1.3; 1.2.0 through 1.2.3 |
| CVE-2021-41133 | 7.8 | Oct 8 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux Affected: before 1.8.2; 1.10.0 before 1.10.4; 1.11.1 before 1.12.1 |
| CVE-2017-9780 | 7.8 | Jun 21 | In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable Affected: through 0.8.6 |
| CVE-2026-34079 | 7.5 | Apr 7 | Flatpak affected by arbitrary file deletion on the host filesystem Affected: < 1.16.4 |
| CVE-2026-96808 | 7.4 | Sep 23 | In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal Affected: before 1.18.1 |
| CVE-2026-90616 | 7.4 | Sep 12 | In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the… Affected: before 1.18.1 |
| CVE-2026-92162 | 7.2 | Oct 20 | Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream Affected: < 1.18.1 |
| CVE-2023-28100 | 6.5 | Mar 16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux Affected: before 1.10.8; 1.12.0 before 1.12.8; 1.14.0 before 1.14.4; 1.15.0 before 1.15.4 |
| CVE-2022-21682 | 6.5 | Jan 13 | Flatpak is a Linux application sandboxing and distribution framework Affected: before 1.10.7; 1.11.1 before 1.12.4 |
| CVE-2023-28101 | 4.3 | Mar 16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux Affected: before 1.10.8; 1.12.0 before 1.12.8; 1.14.0 before 1.14.4; 1.15.0 before 1.15.4 |
| CVE-2026-96807 | 4.0 | Sep 23 | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location Affected: before 1.18.1 |
Showing 19