CVE-2026-93676

LowCVSS 3.2/10Last modified Sep 22, 2026

Description

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 18, 2026
Last modified
Sep 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-936776.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitiCVE-2026-936787.6IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorizatCVE-2026-936794.3IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource CVE-2026-93687.3A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_eCVE-2026-936816.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name ParaCVE-2026-936825.8When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one CVE-2026-936836.4A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than onceCVE-2026-936845.4An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run iCVE-2026-936855.4A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misCVE-2026-936877.5braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeplCVE-2026-936887.5SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowCVE-2026-936895.5WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails
CVE-2026-93676: Low severity, CVSS 3.2 | Vulnix