Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 506
Alerts This Week
Warning Icon 1 506

Stay Secure with the Latest Linux Advisories

Opensuse Large Esm H800
openSUSE

openSUSE Leap 16.0 Beets Moderate Web Issue Fix SUSE-SU-2026-21383-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE Chromium Important Use After Free Issues Fix 2026-21382-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE Leap 16.0 opam Important Security Update 2026-21380-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H800
openSUSE

openSUSE Leap 16.0 ID 21374 Vim Important Code Execution Issues

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE Python-Aiohttp Important Resource Issues Vuln 2026-21372-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE Tumbleweed iscsiuio Moderate CVE-2026-44943 Advisory 2026-11317-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H800
openSUSE

openSUSE Tumbleweed libsoup Moderate CVE-2026-12478 Advisory 2026-11316-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE libgit2 Moderate Security Update for 5 Issues 2026-11315-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE kubevirt1.8-container-disk Moderate Security Update 2026-11314-1

Calendar White Jul 21, 2026
moderate
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 12 articles for you...
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisorythreatimportant

openSUSE yelp Important File Disclosure Risk CVE-2026-13601

An update that solves one vulnerability can now be installed.. # Security update for yelp Announcement ID: SUSE-SU-2026:3036-1 Release Date: 2026-07-15T11:44:33Z Rating: important References: * bsc#1269625 Cross-References: * CVE-2026-13601 CVSS scores: * CVE-2026-13601 ( SUSE ): 6.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N * CVE-2026-13601 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N * CVE-2026-13601 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N * CVE-2026-13601 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N * CVE-2026-13601 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: * Desktop Applications Module 15-SP7 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves one vulnerability can now be installed. ## Description: This update for yelp fixes the following issue * CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Desktop Applications Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-3036=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3036=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3036=1 * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-3036=1 ## Package List: *SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * yelp-debugsource-42.2-150600.3.6.1 * libyelp0-42.2-150600.3.6.1 * yelp-devel-42.2-150600.3.6.1 * libyelp0-debuginfo-42.2-150600.3.6.1 * yelp-debuginfo-42.2-150600.3.6.1 * yelp-42.2-150600.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * yelp-lang-42.2-150600.3.6.1 * openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64) * yelp-debugsource-42.2-150600.3.6.1 * libyelp0-42.2-150600.3.6.1 * yelp-devel-42.2-150600.3.6.1 * libyelp0-debuginfo-42.2-150600.3.6.1 * yelp-debuginfo-42.2-150600.3.6.1 * yelp-42.2-150600.3.6.1 * openSUSE Leap 15.6 (noarch) * yelp-lang-42.2-150600.3.6.1 * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * yelp-debugsource-42.2-150600.3.6.1 * libyelp0-42.2-150600.3.6.1 * yelp-devel-42.2-150600.3.6.1 * libyelp0-debuginfo-42.2-150600.3.6.1 * yelp-debuginfo-42.2-150600.3.6.1 * yelp-42.2-150600.3.6.1 * Desktop Applications Module 15-SP7 (noarch) * yelp-lang-42.2-150600.3.6.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * yelp-debugsource-42.2-150600.3.6.1 * libyelp0-42.2-150600.3.6.1 * yelp-devel-42.2-150600.3.6.1 * libyelp0-debuginfo-42.2-150600.3.6.1 * yelp-debuginfo-42.2-150600.3.6.1 * yelp-42.2-150600.3.6.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * yelp-lang-42.2-150600.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2026-13601.html * https://bugzilla.suse.com/show_bug.cgi?id=1269625 . An essential security update for openSUSE's yelp addresses a significant file disclosure risk. Install it now.. openSUSE security file disclosure update yelp vulnerability. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jul 15, 2026 •Important OpenSUSE
202
Ls Advisories Opensuse Esm H240
Price Tag%201security advisoryimportantOpenSUSE

openSUSE 2026-3037-1 yelp Significant Host Exposure Vulnerability

An update that solves one vulnerability can now be installed.. # Security update for yelp Announcement ID: SUSE-SU-2026:3037-1 Release Date: 2026-07-15T11:45:09Z Rating: important References: * bsc#1269625 Cross-References: * CVE-2026-13601 CVSS scores: * CVE-2026-13601 ( SUSE ): 6.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N * CVE-2026-13601 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N * CVE-2026-13601 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N * CVE-2026-13601 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N * CVE-2026-13601 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for yelp fixes the following issue * CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications (bsc#1269625). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-3037=1 * SUSE Linux Enterprise HighPerformance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-3037=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-3037=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3037=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3037=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-3037=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-3037=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-3037=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-3037=1 ## Package List: * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * yelp-debugsource-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * yelp-lang-41.2-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * yelp-debugsource-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * yelp-lang-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * yelp-debugsource-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 *libyelp0-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * yelp-lang-41.2-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * yelp-lang-41.2-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * yelp-debugsource-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * yelp-debugsource-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * yelp-lang-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * yelp-debugsource-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * yelp-lang-41.2-150400.3.6.1 * openSUSE Leap 15.4 (aarch64 i586 ppc64le s390x x86_64) * yelp-debugsource-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * openSUSE Leap 15.4 (noarch) * yelp-lang-41.2-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * yelp-debugsource-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15SP4 (noarch) * yelp-lang-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * yelp-debugsource-41.2-150400.3.6.1 * yelp-devel-41.2-150400.3.6.1 * yelp-debuginfo-41.2-150400.3.6.1 * libyelp0-debuginfo-41.2-150400.3.6.1 * yelp-41.2-150400.3.6.1 * libyelp0-41.2-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * yelp-lang-41.2-150400.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2026-13601.html * https://bugzilla.suse.com/show_bug.cgi?id=1269625 . An important security update for yelp addresses potential host file disclosure risks due to a lax content security policy.. SUSE Linux, security update, yelp, openSUSE, content security policy. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jul 15, 2026 •Important OpenSUSE
Banner 2 1028x280 1708121730 1 1771599631
197
Ls Advisories Debianlts Esm H240
Price Tag%201security advisorycriticalyelp

Debian LTS Yelp Serious Data Exfiltration Threat DLA-4647-1

A vulnerability was discovered in yelp, the GNOME help browser, that allows a crafted help document to read files accessible to the user and exfiltrate them to a remote server through resources loaded by the embedded web view. When yelp is launched from a sandboxed application (for example via the Flatpak OpenURI portal), this also enables a. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4647-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Daniel Leidert June 25, 2026 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : yelp Version : 3.38.3-1+deb11u2 CVE ID : not assigned Debian Bug : 1136299 A vulnerability was discovered in yelp, the GNOME help browser, that allows a crafted help document to read files accessible to the user and exfiltrate them to a remote server through resources loaded by the embedded web view. When yelp is launched from a sandboxed application (for example via the Flatpak OpenURI portal), this also enables a sandbox escape. For Debian 11 bullseye, this problem has been fixed in version 3.38.3-1+deb11u2. We recommend that you upgrade your yelp packages. For the detailed security status of yelp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/yelp Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Explore the critical security update for Yelp addressing a file read and exfiltration vulnerability present in Debian LTS.. yelp, security update, Debian LTS, critical vulnerability, sandbox escape. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jun 24, 2026 •Critical Debian LTS
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorydebianimportant

Debian yelp Important Information Disclosure Sandbox Escape DSA-6319-1

A vulnerability was discovered in yelp, the GNOME help browser, that allows a crafted help document to read files accessible to the user and exfiltrate them to a remote server through resources loaded by the embedded web view. When yelp is launched from a sandboxed application (for example via the Flatpak OpenURI portal), this also enables a. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6319-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Aron Xu June 02, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : yelp CVE ID : Debian Bug : 1136299 A vulnerability was discovered in yelp, the GNOME help browser, that allows a crafted help document to read files accessible to the user and exfiltrate them to a remote server through resources loaded by the embedded web view. When yelp is launched from a sandboxed application (for example via the Flatpak OpenURI portal), this also enables a sandbox escape. For the oldstable distribution (bookworm), this problem has been fixed in version 42.2-1+deb12u2. For the stable distribution (trixie), this problem has been fixed in version 42.2-4+deb13u1. We recommend that you upgrade your yelp packages. For the detailed security status of yelp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/yelp Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian Security Advisory DSA-6319-1 addresses an important issue in yelp, the GNOME help browser, related to information disclosure.. Debian Security Advisory, yelp security issue, GNOME help browser, information disclosure. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jun 02, 2026 •Important Debian
Banner 2 1028x280 1708121730 1 1771599631
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorydebianimportant

Debian yelp Significant Data Retrieval Vulnerability DSA-6319-1

A vulnerability was discovered in yelp, the GNOME help browser, that allows a crafted help document to read files accessible to the user and exfiltrate them to a remote server through resources loaded by the embedded web view. When yelp is launched from a sandboxed application (for example via the Flatpak OpenURI portal), this also enables a. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6319-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Aron Xu June 02, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : yelp CVE ID : Debian Bug : 1136299 A vulnerability was discovered in yelp, the GNOME help browser, that allows a crafted help document to read files accessible to the user and exfiltrate them to a remote server through resources loaded by the embedded web view. When yelp is launched from a sandboxed application (for example via the Flatpak OpenURI portal), this also enables a sandbox escape. For the oldstable distribution (bookworm), this problem has been fixed in version 42.2-1+deb12u2. For the stable distribution (trixie), this problem has been fixed in version 42.2-4+deb13u1. We recommend that you upgrade your yelp packages. For the detailed security status of yelp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/yelp Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Discover the recent yelp vulnerability in Debian that allows unauthorized file access and remote data exfiltration.. Debian security, yelp vulnerability, data exfiltration, sandbox escape, GNOME help browser. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jun 02, 2026 •Important Debian
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoracritical

Fedora 44 Yelp 49.1 Critical CSP Exfiltration Advisory 2026-ed4f450fa9

Yelp 49.1, fixing: Flatpak applications are able to exfiltrate host files due to yelp's CSP being too permissive. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-ed4f450fa9 2026-05-17 01:26:47.130151+00:00 -------------------------------------------------------------------------------- Name : yelp Product : Fedora 44 Version : 49.1 Release : 1.fc44 URL : https://wiki.gnome.org/Apps/Yelp Summary : Help browser for the GNOME desktop Description : Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. -------------------------------------------------------------------------------- Update Information: Yelp 49.1, fixing: Flatpak applications are able to exfiltrate host files due to yelp's CSP being too permissive -------------------------------------------------------------------------------- ChangeLog: * Wed May 6 2026 Packit - 2:49.1-1 - Update to 49.1 upstream release * Mon Mar 2 2026 Jan Grulich - 2:49.0-5 - Packit: drop upstream_project_url and rely on release-monitoring only * Wed Feb 25 2026 Jan Grulich - 2:49.0-4 - Packit: drop fast_forward_merge_into as current stable branches diverge * Tue Feb 24 2026 Jan Grulich - 2:49.0-3 - Onboard to Packit for stable Fedora branches -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-ed4f450fa9' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Yelp 49.1 update addresses CSP issues allowing Flatpak apps to exfiltrate host files, enhancing security on Fedora 44.. Fedora 44, Yelp application, security update, Flatpak issues, critical advisory. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 May 17, 2026 •Critical Fedora
Banner 2 1028x280 1708121730 1 1771599631
89
Ls Advisories Fedora Esm H240
Price Tag%201security advisoryfedoravulnerability

Fedora 43 Yelp 49.1 Critical CSP Exfiltration Fix FEDORA-2026-7c3b91a2bc

Yelp 49.1, fixing: Flatpak applications are able to exfiltrate host files due to yelp's CSP being too permissive. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-7c3b91a2bc 2026-05-17 00:48:46.610603+00:00 -------------------------------------------------------------------------------- Name : yelp Product : Fedora 43 Version : 49.1 Release : 1.fc43 URL : https://wiki.gnome.org/Apps/Yelp Summary : Help browser for the GNOME desktop Description : Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. -------------------------------------------------------------------------------- Update Information: Yelp 49.1, fixing: Flatpak applications are able to exfiltrate host files due to yelp's CSP being too permissive -------------------------------------------------------------------------------- ChangeLog: * Wed May 6 2026 Packit - 2:49.1-1 - Update to 49.1 upstream release -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-7c3b91a2bc' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Yelp 49.1 for Fedora 43 fixes a critical CSP issue that allows Flatpak applications to exfiltrate files.. Fedora Update,yelp security,Flatpak host access. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 May 17, 2026 •Critical Fedora
100
Ls Advisories Suse Esm H240
Price Tag%201security advisorymoderateSUSE

SUSE Linux 12 SP5 moderate: yelp CVE-2025-3155 JavaScript issue

* bsc#1240688 Cross-References: * CVE-2025-3155 . # Security update for yelp Announcement ID: SUSE-SU-2025:02169-1 Release Date: 2025-06-30T07:15:20Z Rating: moderate References: * bsc#1240688 Cross-References: * CVE-2025-3155 CVSS scores: * CVE-2025-3155 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2025-3155 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2025-3155 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Affected Products: * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for yelp fixes the following issues: * CVE-2025-3155: JavaScript code execution and arbitrary file read through specially crafted help files and ghelp scheme URLs (bsc#1240688). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-2169=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * libyelp0-3.20.1-7.3.1 * libyelp0-debuginfo-3.20.1-7.3.1 * yelp-debugsource-3.20.1-7.3.1 * yelp-devel-3.20.1-7.3.1 * yelp-debuginfo-3.20.1-7.3.1 * yelp-3.20.1-7.3.1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch) * yelp-lang-3.20.1-7.3.1 ## References: * https://www.suse.com/security/cve/CVE-2025-3155.html * https://bugzilla.suse.com/show_bug.cgi?id=1240688 . An update for Yelp on SUSE has been released to address CVE-2025-3155, which is a vulnerability categorized as moderate risk, potentially allowing for remote code execution.. SUSE yelpsecurity update JavaScript execution threat. . LinuxSecurity.com Team

Calendar%202 Jun 30, 2025 SuSE
Banner 2 1028x280 1708121730 1 1771599631
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics