xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

Important: Red Hat Security Advisory: xdg-dbus-proxy security update

An update for xdg-dbus-proxy is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-104592

A flaw was found in libosmocore. An out-of-bounds read vulnerability in the Cell Broadcast Service Protocol CBSP message decoder allows a remote attacker to cause a Denial of Service DoS. By sending specially crafted CBSP WRITE-REPLACE messages, an attacker can trigger an invalid memory read,...

PT-2026-127204

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was...

PT-2026-126682

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents...

PT-2026-126681

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents...

PT-2026-127239

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded sscanf in res pjsip pubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated...

CentOS Linux 8.5 [TuxCare] Security Update: pacemaker / pacemaker-cli / pacemaker-cluster-libs / pacemaker-cts / etc (CENTOS8.5:CLSA-2026:1793099293)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793099293 advisory. - A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message...

Oracle Linux 9 : xdg-dbus-proxy (ELSA-2026-90522)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-90522 advisory. 0.1.3-1.1 - Message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Resolves: RHEL-271548 Tenable has extracted the preceding descriptio...

Oracle Linux 10 : xdg-dbus-proxy (ELSA-2026-90523)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-90523 advisory. 0.1.5-4.1 - Message filtering bypass via reply serial allows sandbox escape CVE-2026-94422 Resolves: RHEL-271542 Tenable has extracted the preceding descripti...

ALSA-2026:90522 Important: xdg-dbus-proxy security update

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fixes: xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows...

ALSA-2026:90523 Important: xdg-dbus-proxy security update

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fixes: xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146323 advisory. In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses ...

Important: xdg-dbus-proxy security update

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fixes: xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows...

TencentOS Server 4: xdg-dbus-proxy (TSSA-2026:1181)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1181 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-116477

A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure...

EUVD-2026-110072

A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure...

CVE-2026-116632 Facetime protocol handler enabled spoofing

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1...

EUVD-2026-110067

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1...