4312 matches found
CVE-2026-65636
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
CVE-2026-65636
The CVE-2026-65636 issue affects the ymlr library (Elixir.Ymlr) and its document encoding entry points (Ymlr.document!/2, Ymlr.documents!/2, Ymlr.documents/2). An attacker-controlled comment string is interpolated behind a single #, and CRLF sequences terminate the YAML comment, allowing injectio...
EUVD-2026-51537
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
EEF-CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments
Summary Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a...
Kubernetes API Server - YAML Parsing DoS (Billion Laughs)
The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption Billion Laughs attack, leading to API server crash. id: CVE-2019-11253 info: name: Kubernetes API Serv...
CVE-2026-13676 vulnerabilities
Vulnerabilities for packages: vitess, yaml-language-server...
GHSA-4C8G-83QW-93J6 vulnerabilities
Vulnerabilities for packages: vitess, yaml-language-server...
PT-2026-66757
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...
Security update for yq (important)
openSUSE security update: security update for yq ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21500-1 Rating: important References: bsc1267199 bsc1271994 Cross-References: CVE-2026-39821 CVE-2026-56852 CVSS scores: CVE-2026-39821 SUSE : 7.4...
SUSE SLES15 Security Update : yq (SUSE-SU-2026:3327-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3327-1 advisory. Update to v4.53.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass a...
openSUSE 16 Security Update : yq (openSUSE-SU-2026:21454-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21454-1 advisory. Changes in yq: - Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good bsc1267199. - update to v4.53.3 Add...
CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path
Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...
CVE-2026-54659
Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...
CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path
Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...
Pagy I18n locale option is not validated before being used in a file path
Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...
Security update for yq
This update for yq fixes the following issues: Update to v4.53.3. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1267199. CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...