Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
190 results · page 2 of 4
Dec 8, 2025HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCCVE-2025-63721 · Other software · Hummerrisk · reported by MITREHigh 8.8
HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.
- Product
- Hummerrisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 13, 2025js-yaml is a JavaScript YAML parser and dumper.CVE-2025-64718 · Other software · nodeca · reported by GitHubMedium 5.3
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).
- Product
- js-yaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminaCVE-2025-11683 · Other software · TODDR · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 6.5
YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
- Product
- YAML::Syck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
Aug 1, 2025A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from thCVE-2025-50460 · Other software · reported by MITRECritical 9.8
A remote code execution (RCE) vulnerability exists in the ms-swift project version 3.3.0 due to unsafe deserialization in tests/run.py using yaml.load() from the PyYAML library (versions = 5.3.1). If an attacker can control the content of the YAML configuration file passed to the --run_config parameter, arbitrary code can be executed during deserialization. This can lead to full system compromise. The vulnerability is triggered when a malicious YAML file is loaded, allowing the execution of arbitrary Python commands such as os.system(). It is recommended to upgrade PyYAML to version 5.4 or higher, and to use yaml.safe_load() to mitigate the issue.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2025YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modifiedCVE-2025-40908 · Other software · TINITA · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.1
YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified
- Product
- YAML::LibYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parametersCVE-2024-39780 · Other software · Open Source Robotics Foundation · reported by security@ubuntu.comHigh 7.8
A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.
- Product
- Robot Operating System (ROS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessiCVE-2024-10846 · Other software · compose-spec · reported by security@docker.comMedium 5.9
The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included
- Product
- compose-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Nov 27, 2024When exporting media types, the password is exported in the YAML in plain text.CVE-2024-36464 · Other software · Zabbix · reported by security@zabbix.comLow 2.7
When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Nov 14, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37285 · Other software · Elastic · reported by security@elastic.coCritical 9.1
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest* * The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted * Under Integration the Read or All privilege is granted * Access to the fleet-setup privilege is gained through the Fleet Server’s service account token
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024IBM ManageIQ could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted yaml file request.CVE-2024-43191 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM ManageIQ could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted yaml file request.
- Product
- Cloud Pak for Multicloud Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).CVE-2024-42323 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes the issue.
- Product
- Apache HertzBeat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Sep 9, 2024A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload.CVE-2024-37288 · Other software · Elastic · reported by security@elastic.coCritical 9.9
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue only affects users that use Elastic Security’s built-in AI tools https://www.elastic.co/guide/en/security/current/ai-for-security.html and have configured an Amazon Bedrock connector https://www.elastic.co/guide/en/security/current/assistant-connect-to-bedrock.html .
- Product
- Kibana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Nuclei is a vulnerability scanner powered by YAML based templates.CVE-2024-43405 · Other software · projectdiscovery · reported by GitHubHigh 7.4
Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template signature verification system could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template. The vulnerability is present in the template signature verification process, specifically in the `signer` package. The vulnerability stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, combined with the way multiple signatures are processed. This allows an attacker to inject malicious content into a template while maintaining a valid signature for the benign part of the template. CLI users are affected if they execute custom code templates from unverified sources. This includes templates authored by third parties or obtained from unverified repositories. SDK Users are affected if they are developers integrating Nuclei into their platforms, particularly if they permit the execution of custom code templates by end-users. The vulnerability is addressed in Nuclei v3.3.2. Users are strongly recommended to update to this ve
- Product
- nuclei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2024Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL.CVE-2024-40641 · Other software · projectdiscovery · reported by GitHubHigh 7.4
Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In this case, users can execute arbitrary commands. (Although, as far as I know, most web applications use -t to execute). This issue has been addressed in version 3.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- nuclei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file.CVE-2024-35060 · Other software · nasa · reported by MITREHigh 7.5
An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file.
- Product
- ait-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Apr 25, 2024Portainer before 2.20.0 allows redirects when the target is not index.yaml.CVE-2024-33661 · Other software · portainer · reported by MITRECritical 9.1
Portainer before 2.20.0 allows redirects when the target is not index.yaml.
- Product
- portainer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file.CVE-2024-3625 · Other software · Red Hat · reported by Red HatHigh 7.3
A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance.
- Product
- mirror registry for Red Hat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Apr 25, 2024A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file.CVE-2024-3624 · Other software · Red Hat · reported by Red HatHigh 7.3
A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay's database.
- Product
- mirror registry for Red Hat OpenShift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Mar 15, 2024projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL.CVE-2024-27920 · Other software · projectdiscovery · reported by GitHubHigh 7.4
projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provides details on the security patch, and suggests mitigation strategies. The vulnerability is addressed in Nuclei v3.2.0. Users are strongly recommended to update to this version to mitigate the security risk. Users should refrain from using custom workflows if unable to upgrade immediately. Only trusted, verified workflows should be executed.
- Product
- nuclei
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.projectdiscovery.iodocs.projectdiscovery.io
Mar 7, 2024nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.CVE-2024-28212 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.
- Product
- nGrinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Jan 21, 2024The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.CVE-2024-23731 · Other software · Embedchain · reported by MITRECritical 9.8
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
- Product
- Embedchain
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023Apache Software Foundation Apache Submarine has a bug when serializing against yaml.CVE-2023-46302 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests (using application/yaml content-type), it defines a YamlEntityProvider entity provider that will process all incoming YAML requests. In order to unmarshal the request, the readFrom method is invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`. We have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`. This issue affects Apache Submarine: from 0.7.0 before 0.8.0. Users are recommended to upgrade to version 0.8.0, which fixes this issue. If using the version smaller than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1054 and rebuild the submart-server image to fix this.
- Product
- Apache Submarine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comissues.apache.org
Nov 12, 2023Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack.CVE-2023-47163 · Other software · Remarshal-project · reported by vultures@jpcert.or.jpHigh 7.5
Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition.
- Product
- Remarshal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2023Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.CVE-2023-47204 · Other software · Toumorokoshi · reported by MITRECritical 9.8
Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.
- Product
- Transmute-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie.CVE-2023-26153 · Other software · Geokit · reported by report@snyk.ioHigh 8.3
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value. **Note:** An attacker can use this vulnerability to execute commands on the host system.
- Product
- Geokit-rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 25, 2023An issue was discovered in Esoteric YamlBeans through 1.15.CVE-2023-24621 · Other software · Esotericsoftware · reported by MITREHigh 7.8
An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.
- Product
- Yamlbeans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcontrastsecurity.comgithub.com
Aug 25, 2023An issue was discovered in Esoteric YamlBeans through 1.15.CVE-2023-24620 · Other software · Esotericsoftware · reported by MITREMedium 5.5
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size, causing CPU and memory consumption, such as a Java Out-of-Memory exception.
- Product
- Yamlbeans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcontrastsecurity.comgithub.com
Aug 21, 2023An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.CVE-2023-39106 · Other software · Alibabacloud · reported by MITREHigh 8.8
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
- Product
- Nacos Spring Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file.CVE-2021-31681 · Other software · Ultralytics · reported by MITREHigh 7.8
Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file.
- Product
- Yolov3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file.CVE-2021-31680 · Other software · Ultralytics · reported by MITREHigh 7.8
Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file.
- Product
- Yolov5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineCVE-2023-38647 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation. Affect all the versions lower and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configuration and workflow creation. Long term, all Helix version bumping up to 1.3.0
- Product
- Apache Helix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jul 19, 2023Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML CVE-2023-28754 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML configuration file. The attacker needs to have permission to modify the ShardingSphere Agent YAML configuration file on the target machine, and the target machine can access the URL with the arbitrary code JAR. An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. When the ShardingSphere JVM process starts and uses the ShardingSphere-Agent, the arbitrary code specified by the attacker will be executed during the deserialization of the YAML configuration file by the Agent. This issue affects ShardingSphere-Agent: through 5.3.2. This vulnerability is fixed in Apache ShardingSphere 5.4.0.
- Product
- ShardingSphere-Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 14, 2023rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OCVE-2023-38337 · Other software · Rswag Project · reported by MITREHigh 7.5
rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.
- Product
- Rswag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.CVE-2023-22970 · Other software · Usebottles · reported by MITREHigh 7.8
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file.
- Product
- Bottles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Apr 24, 2023Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.CVE-2023-2251 · Other software · eemeli · reported by security@huntr.devHigh 7.5
Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.
- Product
- eemeli/yaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2023An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON.CVE-2023-1305 · Other software · Rapid7 · reported by cve@rapid7.comHigh 8.1
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.
- Product
- InsightCloudSec
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.divvycloud.comnephosec.com
Mar 20, 2023kaml provides YAML support for kotlinx.serialization.CVE-2023-28118 · Other software · charleskorn · reported by GitHubHigh 7.5
kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases. There are no known workarounds.
- Product
- kaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.CVE-2022-3064 · Other software · gopkg.in/yaml.v2 · reported by security@golang.orgHigh 7.5
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
- Product
- gopkg.in/yaml.v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources.CVE-2021-4235 · Other software · gopkg.in/yaml.v2 · reported by security@golang.orgMedium 5.5
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
- Product
- gopkg.in/yaml.v2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2022A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allCVE-2022-32224 · Other software · Activerecord Project · reported by support@hackerone.comCritical 9.8
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
- Product
- Activerecord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Dec 1, 2022SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.CVE-2022-1471 · Other software · SnakeYAML · reported by cve-coordination@google.comHigh 8.3
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Nov 11, 2022Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-41854 · Other software · SnakeYaml · reported by cve-coordination@google.comMedium 5.8
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
- Product
- SnakeYaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orglists.fedoraproject.org
Oct 11, 2022The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41380 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-yaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2022Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code executioCVE-2022-41237 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.8
Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
- Product
- Jenkins DotCi Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38752 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38751 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38750 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38749 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Aug 30, 2022The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.CVE-2022-25857 · Other software · Snakeyaml Project · reported by report@snyk.ioHigh 7.5
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
- Product
- Snakeyaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Jul 1, 2022NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load().CVE-2022-31605 · Other software · NVIDIA · reported by psirt@nvidia.comCritical 9.8
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
- Product
- NVIDIA FLARE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.