Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

flatpak: flatpak: Arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

AlmaLinux 8 : flatpak (ALSA-2026:80687)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80687 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data...

ALSA-2026:80497 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

ALSA-2026:80498 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

ALSA-2026:80687 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

RHEL 10 : flatpak (RHSA-2026:80498)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80498 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak:...

AlmaLinux 10 : flatpak (ALSA-2026:80498)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80498 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data...

flatpak security update

1.12.9-4.4 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271518 1.12.9-4.3 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267902 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-26743...

flatpak security update

1.16.0-9.4 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267891 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267432 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271519 1.16.0-9....

flatpak security update

1.12.9-7 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271507 1.12.9-6 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267897 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267425...

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Summary The TinaCMS admin builds its preview from the // hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash ///attacker.example/p becomes the protocol-relative URL //attacker.example/p, so the admin frames an external site. That same unvalidated...

Updated flatpak package fixes security vulnerabilities

Arbitrary file deletion in root context via path traversal in deploy directory export/bin. CVE-2026-97023 Arbitrary write in root context via path traversal in deploy directory files/etc. CVE-2026-97024 World-readable oci authentication token in system-helper cache path. CVE-2026-97025...

MGASA-2026-0477 Updated flatpak package fixes security vulnerabilities

Arbitrary file deletion in root context via path traversal in deploy directory export/bin. CVE-2026-97023 Arbitrary write in root context via path traversal in deploy directory files/etc. CVE-2026-97024 World-readable oci authentication token in system-helper cache path. CVE-2026-97025...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc1282514...

SUSE-SU-2026:4610-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...

SUSE CVE-2026-98034

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise checkmapkptraccess permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it...