High
CVE-2026-39850
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 25
Reset filters
High
CVE-2026-25498
Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
High
CVE-2025-68455
Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior
Medium
CVE-2025-48493
Yii 2 Redis may expose AUTH parameters in logs in case of connection failure
Critical
Exploited in attacks
CVE-2024-58136
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
Medium
CVE-2025-2689
yiisoft Yii2 Deserialization of Untrusted Data
High
CVE-2024-4990
Unsafe Reflection in base Component class in yiisoft/yii2
Medium
CVE-2024-32877
Reflected Cross-site Scripting in yiisoft/yii2 Debug mode
Low
CVE-2023-50708
yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation
Medium
CVE-2023-50714
yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable
Critical
CVE-2015-5467
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
High
CVE-2020-36655
Command injection in yiisoft/yii2-gii
Medium
CVE-2022-34297
Yii2 Gii Cross-site Scripting vulnerability
Critical
CVE-2018-7269
Yii SQL injection vulnerability
High
CVE-2018-8074
Yii Framework Code Injection
Medium
CVE-2015-3397
Yii Framework Cross-site Scripting Vulnerability
Medium
CVE-2017-7271
Yii Framework Reflected XSS
Medium
CVE-2017-11516
Yii Cross-site Scripting Framework vulnerability
High
CVE-2018-6009
Yii Framework Cross-Site Request Forgery (CSRF)
Critical
CVE-2018-8073
yii2-redis Potential Remote code execution
Medium
CVE-2018-20745
Yii Incorrectly Implements CORS
High
CVE-2018-6010
Yii Framework reflected Cross-site Scripting
High
CVE-2021-3689
Use of Insufficiently Random Values in yiisoft/yii2-dev
Medium
CVE-2021-3692
Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.