EUVD-2026-48559

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and den...

CVE-2026-16730

dbus-broker is affected. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are treated as fatal, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to t...

CVE-2026-16730

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and den...

PT-2026-64278

Name of the Vulnerable Software and Affected Versions dbus-broker affected versions not specified Description A flaw exists where EMFILE/ENFILE errors, which occur when the process file-descriptor limit is reached during peer setup specifically involving SO PEERPIDFD, are treated as fatal failure...

Amazon Linux 2 : yelp, --advisory ALAS2-2026-3821 (ALAS-2026-3821)

The version of yelp installed on the remote host is prior to 3.28.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3821 advisory. A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious...

MiracleLinux 9 : flatpak-1.12.9-4.el9_8.1 (AXSA:2026-1286:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1286:03 advisory. flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options CVE-2026-34078 flatpak: Flatpak: Arbitrary file deletion o...

Oracle Linux 10 : flatpak (ELSA-2026-21757)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21757 advisory. 1.16.0-9.1 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host...

EUVD-2026-44925

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

CVE-2026-5674 Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

SUSE SLED15 / SLES15 Security Update : yelp (SUSE-SU-2026:3036-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3036-1 advisory. This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host...

SUSE SLES15 Security Update : yelp (SUSE-SU-2026:3037-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3037-1 advisory. This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via...

flatpak security update

1.16.0-9.1 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157...

SUSE SLES12 Security Update : yelp (SUSE-SU-2026:3035-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3035-1 advisory. This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak...

Security update for yelp

This update for yelp fixes the following issue CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:3037-1 Security update for yelp

This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625...

Security update for yelp

This update for yelp fixes the following issue CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:3036-1 Security update for yelp

This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625...

Security update for yelp

This update for yelp fixes the following issue CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2026:3035-1 Security update for yelp

This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625...

OPENSUSE-SU-2026:21295-1 Security update for yelp

This update for yelp fixes the following issue - CVE-2026-13601: overly permissive Content Security Policy allows host file disclosure via Flatpak applications bsc1269625...