Flatpak

Every one of the 19 is a mark on the map. Named now: 1 to 19, most at risk first.

1. Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to…CVE-2019-10063Flatpak · 1.9% likely

   CWE-20

2. flatpak-builder can access files outside the build directory.CVE-2022-21682flatpak · CVSS 7.7 · 1.8% likely

   CWE-22

3. Flatpak has a complete sandbox escape leading to host file access and code execution in the host contextCVE-2026-34078flatpak · CVSS 9 · 1.7% likely

   CWE-61

4. Sandbox escape via special tokens in .desktop fileCVE-2021-21381flatpak · CVSS 7.1 · 1.5% likely

   CWE-74

5. Permissions granted to applications can be hidden from the user at install timeCVE-2021-43860flatpak · CVSS 8.2 · 1.4% likely

   CWE-269

6. Flatpak may allow access to files outside sandbox for certain appsCVE-2024-42472flatpak · CVSS 10 · 1.3% likely

   CWE-74

7. Flatpak metadata with ANSI control codes can cause misleading terminal outputCVE-2023-28101flatpak · CVSS 5 · 0.9% likely

   CWE-116

8. TIOCLINUX can send commands outside sandbox if running on a virtual consoleCVE-2023-28100flatpak · CVSS 10 · 0.9% likely

   CWE-20

9. Flatpak sandbox escape via spawn portalCVE-2021-21261flatpak · CVSS 7.3 · 0.6% likely

   CWE-74

10. Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsingCVE-2024-32462flatpak · CVSS 8.4 · 0.5% likely

    CWE-88

11. Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.CVE-2019-8308Flatpak · 0.5% likely

    CWE-668

12. Sandbox bypass via recent VFS-manipulating syscallsCVE-2021-41133flatpak · CVSS 8.8 · 0.4% likely

    CWE-20

13. In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whit…CVE-2018-6560Flatpak · 0.4% likely

    CWE-436

14. In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The fil…CVE-2017-9780Flatpak · 0.4% likely

    CWE-732

15. Flatpak affected by arbitrary file deletion on the host filesystemCVE-2026-34079flatpak · CVSS 7.5 · 0.3% likely

    CWE-22

16. Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstreamCVE-2026-92162flatpak · CVSS 7.2 · 0.2% likely

    CWE-22

17. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host…CVE-2026-90616Flatpak · CVSS 7.4 · 0.2% likely

    CWE-61

18. In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The f…CVE-2026-96807Flatpak · CVSS 4 · 0.1% likely

    CWE-61

19. In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal ..…CVE-2026-96808Flatpak · CVSS 7.4 · 0.1% likely

    CWE-61

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.