FL
Vendor
flatpak
25
CVEs
0
On KEV
3
New 30D
Products
FL10.0
flatpak
flatpak
19 CVEs0 on KEV1 new
XD8.8
xdg-desktop-portal
flatpak
3 CVEs0 on KEV2 new
FL6.5
flatpak-builder
flatpak
2 CVEs0 on KEV0 new
XD5.5
xdg-dbus-proxy
flatpak
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-55888 New | XD xdg-desktop-portal flatpak | 8.8 | Oct 23 | XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal |
| CVE-2026-55889 New | XD xdg-desktop-portal flatpak | 8.3 | Oct 23 | XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key |
| CVE-2026-92162 | FL flatpak flatpak | 7.2 | Oct 20 | Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream |
| CVE-2026-96808 | FL Flatpak Flatpak | 7.4 | Sep 23 | In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal |
| CVE-2026-96807 | FL Flatpak Flatpak | 4.0 | Sep 23 | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location |
| CVE-2026-90616 | FL Flatpak Flatpak | 7.4 | Sep 12 | In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the… |
| CVE-2026-40354 | XD xdg-desktop-portal Flatpak | 6.3 | Apr 11 | Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash |
| CVE-2026-39977 | FL flatpak-builder flatpak | 6.3 | Apr 9 | flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files |
| CVE-2026-34079 | FL flatpak flatpak | 7.5 | Apr 7 | Flatpak affected by arbitrary file deletion on the host filesystem |
| CVE-2026-34078 | FL flatpak flatpak | 10.0 | Apr 7 | Flatpak has a complete sandbox escape leading to host file access and code execution in the host context |
| CVE-2026-34080 | XD xdg-dbus-proxy flatpak | 5.5 | Apr 7 | xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception |
| CVE-2024-42472 | FL Flatpak Flatpak | 10.0 | Aug 15 | Flatpak is a Linux application sandboxing and distribution framework |
| CVE-2024-32462 | FL Flatpak Flatpak | 8.4 | Apr 18 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux |
| CVE-2023-28101 | FL Flatpak Flatpak | 4.3 | Mar 16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux |
| CVE-2023-28100 | FL Flatpak Flatpak | 6.5 | Mar 16 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux |
| CVE-2022-21682 | FL Flatpak Flatpak | 6.5 | Jan 13 | Flatpak is a Linux application sandboxing and distribution framework |
| CVE-2021-43860 | FL Flatpak Flatpak | 8.6 | Jan 12 | Flatpak is a Linux application sandboxing and distribution framework |
| CVE-2021-41133 | FL Flatpak Flatpak | 7.8 | Oct 8 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux |
| CVE-2021-21381 | FL Flatpak Flatpak | 8.2 | Mar 11 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux |
| CVE-2021-21261 | FL Flatpak Flatpak | 8.8 | Jan 14 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux |
| CVE-2019-10063 | FL Flatpak Flatpak | 9.0 | Mar 26 | Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass |
| CVE-2019-8308 | FL Flatpak Flatpak | 8.2 | Feb 12 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file |
| CVE-2018-6560 | FL Flatpak Flatpak | 8.8 | Feb 2 | In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because… |
| CVE-2017-9780 | FL Flatpak Flatpak | 7.8 | Jun 21 | In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable |