https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:10:31.151633+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-185012 EUVD-2026-185012 2026-10-04T01:10:31.156164+00:00 EUVD-2026-185012 https://cve.radiocsirt.org/vuln/fkie_cve-2020-11934 fkie_cve-2020-11934 2026-10-04T01:10:31.156200+00:00

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

 https://cve.radiocsirt.org/vuln/ghsa-8cwp-mjww-pqc2 GHSA-8cwp-mjww-pqc2 2026-10-04T01:10:31.156235+00:00

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

 https://cve.radiocsirt.org/vuln/gsd-2020-11934 gsd-2020-11934 2026-10-04T01:10:31.156255+00:00 gsd-2020-11934 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-11934 UBUNTU-CVE-2020-11934 2026-10-04T01:10:31.156266+00:00

Affected: Ubuntu:16.04:LTS: snapd, Ubuntu:18.04:LTS: snapd, Ubuntu:20.04:LTS: snapd

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.