Medium
ghsa-r3ph-w7gj-g6xm
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 15
Reset filters
High
CVE-2026-84375
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
High
ghsa-5p4m-2wfm-xmqj
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
High
CVE-2026-73643
js-yaml: Exponential parsing time in flow collections leads to denial of service
High
CVE-2026-13311
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
Medium
CVE-2026-59868
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
High
CVE-2026-59869
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Medium
CVE-2026-59870
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
Medium
CVE-2026-53550
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Medium
CVE-2025-64718
js-yaml has prototype pollution in merge (<<)
High
CVE-2020-7738
Arbitrary Code Execution in shiba
High
CVE-2020-7729
Arbitrary Code Execution in grunt
Medium
ghsa-2pr6-76vf-7546
Denial of Service in js-yaml
High
ghsa-8j8c-7jfh-h6hx
Code Injection in js-yaml
Critical
CVE-2013-4660
Deserialization Code Execution in js-yaml
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.