Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93676

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

CVSS 3.1 3.2 LOWCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-93676

Published

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93676

Published

xdg-dbus-proxy

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "xdg-dbus-proxy",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10"
                    ]
                }

xdg-dbus-proxy

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "xdg-dbus-proxy",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:9"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON