rootpwn

critical · CVSS v3 9.1

CVE-2026-97027

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.deskto…

Description

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.

Scores

Severity
critical
CVSS v2
2.1
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-101261

Ziroom ZHOME A0101 firmware 1.0.1.0 contains a command injection vulnerability in the /api/ZRnetwork/firstSetup_wifi endpoint. Remote attackers can supply a crafted login_pwd parameter to execute arbitrary commands. This flaw could allow full compromise of the device.

View analysis

critical

CVE-2026-101354

A stack-based buffer overflow exists in the _tWlanTask function of the MmtAtePrase Parser in FAST FAC1203R firmware 20200116_2.0.4. The flaw can be triggered by a local network attacker and may allow arbitrary code execution. The vulnerability is rated critical with a CVSS v3 score of 9.6.

View analysis

critical

CVE-2026-101860

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-102240

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis