Yahoo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-92751 CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operaHigh 7.2 · Sep 16, 2026
• CVE-2022-24827 Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort.High 8.1 · Apr 11, 2022
• CVE-2014-7216 Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly executHigh 9.3 · Sep 11, 2015
• CVE-2008-2111 The ActiveX Control (yNotifier.dll) in Yahoo! Assistant 3.6 and earlier allows remote attackers to execute arbitrary code via unspecified vectors in the YnoifieHigh 9.3 · May 7, 2008
• CVE-2007-4515 Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remoteHigh 9.3 · Aug 31, 2007
• CVE-2007-4391 Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a cHigh 9.3 · Aug 17, 2007
• CVE-2007-4034 Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in High 9.3 · Jul 27, 2007
• CVE-2007-3928 Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users to execute arbitrary code via a long e-mail address in an address book eHigh 7.6 · Jul 20, 2007
• CVE-2007-3147 Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary coHigh 9.3 · Jun 11, 2007
• CVE-2007-3148 Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary coHigh 9.3 · Jun 11, 2007
• CVE-2007-1680 Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows reHigh 9.3 · Apr 5, 2007
• CVE-2006-6603 Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code vHigh 9.3 · Dec 15, 2006
• CVE-2005-0737 Buffer overflow in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode.High 7.5 · May 2, 2005
• CVE-2004-0043 Buffer overflow in Yahoo Instant Messenger 5.6.0.1351 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary coHigh 7.5 · Feb 3, 2004
• CVE-2002-1665 Buffer overflow in Yahoo! Messenger before February 2002 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a High 7.5 · Dec 31, 2002
• CVE-2002-0032 Yahoo! Messenger 5,0,0,1064 and earlier allows remote attackers to execute arbitrary script as other users via the addview parameter of a ymsgr URI.High 7.5 · Jul 26, 2002
• CVE-2002-0320 Buffer overflow in Yahoo! Messenger 5.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long (1) message or (2) IHigh 7.5 · Jun 25, 2002
• CVE-2002-0322 Yahoo! Messenger 4.0 sends user passwords in cleartext, which could allow remote attackers to gain privileges of other users via sniffing.High 7.5 · Jun 25, 2002