Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

149-75% vs 7-day avg of 597

2 critical, 41 high, 60 medium, 26 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	8.3	CVE-2026-55889	XDG Desktop Portal is a desktop integration portal flatpak, XDG Desktop Portalflatpak xdg-desktop-portal, XDG Desktop Portal	NVD	Oct 23 13:17 UTC
CVE-2026-55889XDG Desktop Portal is a desktop integration portal Executive summary The XDG Desktop Portal desktop integration component has security flaws that let sandboxed applications interfere with data or write files outside their sandbox. The advisory describes these as security fixes in release 1.22.1 and recommends updating to that release. The advisory does not state a severity score. Technical summary The advisory describes three security fixes: a predictable key in FileTransfer.RetrieveFiles that lets a malicious sandboxed application redirect drag-and-drop and copy-paste data to itself (GHSA-c5cf-79w8-pvfh), arbitrary write access to nonexistent files outside the sandbox via the files option in FileChooser.SaveFiles (GHSA-cm83-2936-gxjm), and unvalidated App IDs in the Document Portal that can cause arbitrary host files to be parsed as Glib.KeyFile objects (#2023). The vulnerability classes are not named beyond these descriptions, and the attack preconditions beyond a malicious sandboxed application are not stated. Affected version ranges are not stated, though the fixes are included in 1.22.1. No CVSS score, workaround, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/flatpak/xdg-desktop-portal/releases/tag/1.22.1 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects flatpak XDG Desktop Portal flatpak xdg-desktop-portal XDG Desktop Portal NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.8	CVE-2026-55888	XDG Desktop Portal is a desktop integration portal flatpak, XDGflatpak xdg-desktop-portal, XDG Desktop Portal	NVD	Oct 23 13:17 UTC
CVE-2026-55888XDG Desktop Portal is a desktop integration portal Executive summary The advisory concerns XDG Desktop Portal, a desktop integration component, and describes several security fixes in release 1.22.1. The issues let sandboxed applications interfere with data transfers or write to or read files outside their sandbox. The advisory does not state a severity score, and the fixes are delivered in version 1.22.1. Technical summary The advisory describes three security fixes: a predictable key in FileTransfer.RetrieveFiles that lets a malicious sandboxed application redirect drag-and-drop and copy-paste data to itself (GHSA-c5cf-79w8-pvfh), arbitrary write access to nonexistent files outside the sandbox via the files option in FileChooser.SaveFiles (GHSA-cm83-2936-gxjm), and unvalidated App IDs in the Document Portal that could cause arbitrary host files to be parsed as Glib.KeyFile objects (#2023). The fixed release is 1.22.1. Affected version ranges, CVSS score, exploitation status, workarounds, and detection guidance are not stated in the advisory. The attack requires a malicious sandboxed application. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/flatpak/xdg-desktop-portal/releases/tag/1.22.1 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects flatpak XDG flatpak xdg-desktop-portal XDG Desktop Portal NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.2	CVE-2026-92162	Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux flatpakflatpak	NVD	Oct 20 15:17 UTC
CVE-2026-92162Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux From the advisory Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local session could use a crafted architecture name to trick the `flatpak-system-helper` process into creating a root-owned directory tree with contents determined by the OCI remote, plus a root-owned `lock` file and `icons` directory, outside the intended root directory. If this vulnerability is combined with other vulnerabilities also fixed in 1.18.1, the combination can lead to local root privilege escalation. This particular vulnerability is not believed to be exploitable if there are no OCI remotes configured (common on non-Fedora systems). Version 1.18.1 patches the issue. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects flatpak flatpak NIST National Vulnerability DatabasePublished Oct 20, 2026 15:17 UTC Read the advisory
	High	8.8	RHSA-2026:89733	flatpak security update Red Hat, flatpakRed Hat Enterprise Linux, flatpak, Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6, Red Hat Enterprise Linux Server - AUS 9.6, Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6, Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6, Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6, Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6, Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6, Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6, Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6, Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6	Red Hat Security Advisories	Oct 26 02:12 UTC
RHSA-2026:89733CVE-2026-90616CVE-2026-96275CVE-2026-96280CVE-2026-96808flatpak security update Executive summary Red Hat published advisory RHSA-2026:89733 for the flatpak package, which is used to build, distribute, and run sandboxed desktop applications on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. Red Hat rates the update Important and lists four security flaws that can lead to code execution or privilege escalation. Red Hat recommends applying the flatpak update described in the advisory. Technical summary The advisory lists four flaws in flatpak: missing symlink protection leading to arbitrary code execution (CVE-2026-90616), extra-data extraction giving arbitrary write access as root (CVE-2026-96275), a buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280), and local privilege escalation via symlink traversal in the revokefs writer (CVE-2026-96808). The fixed package version is flatpak-1.12.9-4.el9_6.5, as written in the advisory. The advisory does not state CVSS scores in the text provided, attack preconditions beyond the descriptions above, workarounds, or exploitation in the wild, and it refers readers to the CVE pages and to https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89733 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat flatpak Red Hat Enterprise Linux flatpak Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 Red Hat Enterprise Linux Server - AUS 9.6 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 Red Hat Product SecurityPublished Oct 26, 2026 02:12 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee