Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
4882 articles · 221206 vulns · 37/41 feeds (7d)
← Back to list
3.2
CVE-2026-93676EXPLOITED
red hat · red hat enterprise linux

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

Description

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.

Affected Products

VendorProductVersions
red hatred hat enterprise linux—

References

  • https://access.redhat.com/security/cve/CVE-2026-93676(vdb-entry, x_refsource_REDHAT)
  • https://bugzilla.redhat.com/show_bug.cgi?id=2537014(issue-tracking, x_refsource_REDHAT)

Related News (2 articles)

Tier C
oss-security9h ago
Re: xdg-dbus-proxy: GHSA-r7hp-698j-2h6c: broadcast message filtering bypass
→ No new info (linked only)
Tier C
VulDB4d ago
CVE-2026-93676 | Red Hat Enterprise Linux Broadcast Message Filter improper authorization
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.13.2 NONE
CISA KEV❌ No
Actively exploited✅ Yes
CWECWE-284
PublishedSep 18, 2026
Last enriched4d ago
Tags
remote code executionfile manipulationdenial of servicemultiple vulnerabilities
Trending Score49
Source articles2
Independent2
Info Completeness5/14
Missing: vendor, product, versions, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

NONECVE-2026-94184EXP
Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)
Trending: 59
NONECVE-2026-87766EXP
Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
Trending: 55
NONECVE-2026-93558
Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
Trending: 41
NONECVE-2026-93562
Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
Trending: 41
NONECVE-2026-95511
Cups: cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root)
Trending: 41

Pin to Dashboard

Verification

State: verified
Confidence: 100%

Vulnerability Timeline

CVE Published
Sep 18, 2026
Discovered by ZDM
Sep 18, 2026
Actively Exploited
Sep 22, 2026
Exploit Available
Sep 22, 2026