Gnome Yelp vulnerabilities

3 CVEs affecting Gnome Yelp, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-13601, published 2026-06-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-3533, published 2008-08-18. High severity, CVSS 10.0. EPSS: 19.4% chance of exploitation in the next 30 days. Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers…
CVE-2025-3155, published 2025-04-03. High severity, CVSS 7.4. EPSS: 13.1% chance of exploitation in the next 30 days. A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may…
CVE-2026-13601, published 2026-06-29. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the…