4608 matches found
UBUNTU-CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15...
CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15...
Linux Distros Unpatched Vulnerability : CVE-2026-84375
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count...
DEBIAN-CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...
CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...
CVE-2026-84375
A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...
CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...
CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...
CVE-2026-84375
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge targets,...
CVE-2026-84375
js-yaml , a widely used JavaScript YAML parser, is vulnerable to a CPU exhaustion issue in its merge-key (<
CVE-2026-84202
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
CVE-2026-84202 ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
CVE-2026-84202
ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 security and extras update
Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.31 security and extras update
Red Hat OpenShift Container Platform release 4.21.31 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...
PT-2026-84523
Name of the Vulnerable Software and Affected Versions js-yaml versions 3.0.0 through 3.15.1 js-yaml versions prior to 4.3.2 Description An issue exists where maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js fails to count empty mapping sources when processing the merge key . This allo...
ROOT-APP-NPM-GHSA-8J8C-7JFH-H6HX GHSA-8j8c-7jfh-h6hx in js-yaml - Patched by Root
Root has patched GHSA-8j8c-7jfh-h6hx in the js-yaml package for Root:npm. Multiple fixed versions available...
osmedeus v5.1.0
Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...
CVE-2026-55559
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/instance into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The...
