https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:02:36.801217+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-373908 EUVD-2026-373908 2026-10-03T10:02:36.868305+00:00 EUVD-2026-373908 https://cve.radiocsirt.org/vuln/fkie_cve-2026-87766 fkie_cve-2026-87766 2026-10-03T10:02:36.868342+00:00

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-87766 msrc_CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup 2026-10-03T10:02:36.868374+00:00 msrc_CVE-2026-87766 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11873-1 openSUSE-SU-2026:11873-1 — flatpak-1.18.3-1.1 on GA media 2026-10-03T10:02:36.868394+00:00

flatpak-1.18.3-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-87766 UBUNTU-CVE-2026-87766 2026-10-03T10:02:36.868413+00:00

Affected: Ubuntu:Pro:18.04:LTS: bubblewrap, Ubuntu:Pro:20.04:LTS: bubblewrap, Ubuntu:22.04:LTS: bubblewrap, Ubuntu:24.04:LTS: bubblewrap, Ubuntu:26.04:LTS: bubblewrap

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.