https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 04:17:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-97027 <p>Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application&#39;s Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.</p> <p>Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application&#39;s Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.</p> https://db.gcve.eu/vuln/fkie_cve-2026-97027 https://db.gcve.eu/vuln/ubuntu-cve-2026-97027 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: flatpak, Ubuntu:Pro:20.04:LTS: flatpak, Ubuntu:Pro:22.04:LTS: flatpak, Ubuntu:Pro:24.04:LTS: flatpak, Ubuntu:26.04:LTS: flatpak</p> <p>Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application&#39;s Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: flatpak, Ubuntu:Pro:20.04:LTS: flatpak, Ubuntu:Pro:22.04:LTS: flatpak, Ubuntu:Pro:24.04:LTS: flatpak, Ubuntu:26.04:LTS: flatpak</p> <p>Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application&#39;s Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-97027