https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:11:29 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:47177 <p><strong>Affected:</strong> AlmaLinux:8: yelp, AlmaLinux:8: yelp-devel, AlmaLinux:8: yelp-libs</p> <p>Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.</p> <p>Security Fix(es):</p> <p>* yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: yelp, AlmaLinux:8: yelp-devel, AlmaLinux:8: yelp-libs</p> <p>Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.</p> <p>Security Fix(es):</p> <p>* yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:47177 https://cve.radiocsirt.org/vuln/euvd-2026-356625 EUVD-2026-356625 https://cve.radiocsirt.org/vuln/euvd-2026-356625 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13601 <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&#39;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.</p> <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&#39;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13601 https://cve.radiocsirt.org/vuln/ghsa-f4vh-qr53-q5gv <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&#39;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.</p> <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&#39;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.</p> https://cve.radiocsirt.org/vuln/ghsa-f4vh-qr53-q5gv https://cve.radiocsirt.org/vuln/oesa-2026-3053 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: yelp, openEuler:22.03-LTS-SP4: yelp, openEuler:24.03-LTS-SP1: yelp, openEuler:24.03-LTS-SP3: yelp, openEuler:24.03-LTS-SP4: yelp</p> <p>Yelp is the help viewer in GNOME. It natively views Mallard, DocBook, man, info, and HTML documents. It can locate documents according to the freedesktop.org help system specification. Security Fix(es):</p> <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&amp;apos;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.(CVE-2026-13601)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: yelp, openEuler:22.03-LTS-SP4: yelp, openEuler:24.03-LTS-SP1: yelp, openEuler:24.03-LTS-SP3: yelp, openEuler:24.03-LTS-SP4: yelp</p> <p>Yelp is the help viewer in GNOME. It natively views Mallard, DocBook, man, info, and HTML documents. It can locate documents according to the freedesktop.org help system specification. Security Fix(es):</p> <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&amp;apos;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.(CVE-2026-13601)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3053 https://cve.radiocsirt.org/vuln/rhsa-2026:47177 <p>yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications</p> <p>yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications</p> https://cve.radiocsirt.org/vuln/rhsa-2026:47177 https://cve.radiocsirt.org/vuln/rlsa-2026:47177 <p><strong>Affected:</strong> Rocky Linux:8: yelp</p> <p>Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.</p> <p>Security Fix(es):</p> <p>* yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:8: yelp</p> <p>Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook.</p> <p>Security Fix(es):</p> <p>* yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:47177 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13601 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: yelp, Ubuntu:Pro:18.04:LTS: yelp, Ubuntu:Pro:20.04:LTS: yelp, Ubuntu:22.04:LTS: yelp, Ubuntu:24.04:LTS: yelp, Ubuntu:25.10: yelp, Ubuntu:26.04:LTS: yelp</p> <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&#39;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: yelp, Ubuntu:Pro:18.04:LTS: yelp, Ubuntu:Pro:20.04:LTS: yelp, Ubuntu:22.04:LTS: yelp, Ubuntu:24.04:LTS: yelp, Ubuntu:25.10: yelp, Ubuntu:26.04:LTS: yelp</p> <p>A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak&#39;s intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13601 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2835 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen und beliebigen Code mit Root-Rechten auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen und beliebigen Code mit Root-Rechten auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2835