CLSA-2025-1751328254 TuxCare security update for org.yaml:snakeyaml (1 CVE)

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.29.tuxcare.1...

CLSA-2025-1752537765 TuxCare security update for org.yaml:snakeyaml (3 CVEs)

TuxCare rebuilt org.yaml:snakeyaml to address 3 CVEs. Fixed in 1.29.tuxcare.3...

CLSA-2024-1732492822 TuxCare security update for org.yaml:snakeyaml (1 CVE)

TuxCare rebuilt org.yaml:snakeyaml to address 1 CVE. Fixed in 1.33.tuxcare.1...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

Sean's Surf & Skate Co. — Seal Security Demo Maven / Java A...

Exploit for Deserialization of Untrusted Data in Snakeyaml_Project Snakeyaml

yaml-payload A SnakeYAML deserialization exploit payload for...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway Desktop Edition due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, SnakeYAML, Spring Beans, Logback Classic and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring...

Exploit for Improper Input Validation in Snakeyaml_Project Snakeyaml

Seal Security — Java Maven Example A minimal, intentionally...

osv-java-poc

OSV Scanner CVE Detection POC — Vulnerable Java App ⚠️ WA...

RCE (Remote Code Execution) org.yaml:snakeyaml Dependency in Confluence Data Center

This Confluence release includes updates to our org.yaml:snakeyaml dependency in response to CVE-2022-1471. Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for...

CVE-2026-1691

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has...

CVE-2026-1691 bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has...

CVE-2026-1691

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has...

CVE-2026-1691

CVE-2026-1691 affects bolo-solo up to 2.6.4, specifically the function importMarkdownsSync in BackupService.java (SnakeYAML). The vulnerability enables deserialization via this pathway, with remote execution potential as stated. The exploit has been disclosed publicly. Connected sources provide v...

CVE-2026-1691 bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has...

CVE-2026-1691: Deserialization of Untrusted Data

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has...

PT-2026-5427

Name of the Vulnerable Software and Affected Versions bolo-solo versions up to 2.6.4 Description A flaw exists in bolo-solo up to version 2.6.4 related to deserialization. The issue resides within the importMarkdownsSync function located in the file...

MiracleLinux 8 : prometheus-jmx-exporter-0.12.0-8.el8 (AXSA:2022-3880:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3880:02 advisory. snakeyaml: Denial of Service due to missing nested depth limitation for collections CVE-2022-25857 Tenable has extracted the preceding description block...

MiracleLinux 8 : prometheus-jmx-exporter-0.12.0-9.el8 (AXSA:2022-4526:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-4526:04 advisory. SnakeYaml: Constructor Deserialization Remote Code Execution CVE-2022-1471 Tenable has extracted the preceding description block directly from the MiracleLin...

CVE-2022-31691

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

Unsafe Deserialization

Apache Submarine is vulnerable to unsafe deserialization. The vulnerability is due to insecure YAML deserialization through the SnakeYAML library in the YamlEntityProvider component, which allows an attacker to supply malicious YAML payloads via REST API requests and potentially execute arbitrary...