https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T20:38:29.367070+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-10037 CVE-2026-10037 — Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal 2026-10-05T20:38:29.368954+00:00

Affected: Canonical Ubuntu

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment.

 https://vulnerability.circl.lu/vuln/usn-8518-1 USN-8518-1 — mailcap vulnerability 2026-10-05T20:38:29.369043+00:00

Affected: Ubuntu:22.04:LTS: mailcap, Ubuntu:24.04:LTS: mailcap, Ubuntu:25.10: mailcap, Ubuntu:26.04:LTS: mailcap

Aaron Rainbolt discovered that the cautious-launcher utility in the mailcap package did not properly restrict the execution of certain file types. An attacker could use this issue to escape a sandboxed application and execute arbitrary code on the host operating system.