Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Dec 8, 2025HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCCVE-2025-63721 · Other software · Hummerrisk · reported by MITREHigh 8.8
HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.
- Product
- Hummerrisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 21, 2024SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).CVE-2024-42323 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes the issue.
- Product
- Apache HertzBeat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Mar 7, 2024nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.CVE-2024-28212 · Other software · NAVER · reported by cve@navercorp.comCritical 9.8
nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.
- Product
- nGrinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.naver.comcve.naver.com
Aug 21, 2023An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.CVE-2023-39106 · Other software · Alibabacloud · reported by MITREHigh 8.8
An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.
- Product
- Nacos Spring Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineCVE-2023-38647 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation. Affect all the versions lower and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configuration and workflow creation. Long term, all Helix version bumping up to 1.3.0
- Product
- Apache Helix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 1, 2022SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.CVE-2022-1471 · Other software · SnakeYAML · reported by cve-coordination@google.comHigh 8.3
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Nov 11, 2022Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-41854 · Other software · SnakeYaml · reported by cve-coordination@google.comMedium 5.8
Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.
- Product
- SnakeYaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orglists.fedoraproject.org
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38752 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38751 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38750 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Sep 5, 2022Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS).CVE-2022-38749 · Other software · snakeyaml · reported by cve-coordination@google.comMedium 6.5
Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
- Product
- SnakeYAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbugs.chromium.org
Aug 30, 2022The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.CVE-2022-25857 · Other software · Snakeyaml Project · reported by report@snyk.ioHigh 7.5
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
- Product
- Snakeyaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Mar 11, 2020In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource CVE-2020-1947 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.
- Product
- Apache ShardingSphere(incubator)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Dec 11, 2019The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.CVE-2017-18640 · Other software · Snakeyaml Project · reported by MITREHigh 7.5
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
- Product
- Snakeyaml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitbucket.orgbitbucket.org
Sep 13, 2017Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs.CVE-2016-8744 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the classpath. This could provide an authenticated user with a means to cause the JVM running Brooklyn to load and run Java code without detection by Brooklyn. Such code would have the privileges of the Java process running Brooklyn, including the ability to open files and network connections, and execute system commands. There is known to be a proof-of-concept exploit using this vulnerability.
- Product
- Apache Brooklyn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbrooklyn.apache.orglists.apache.org
Mar 7, 2017Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability.CVE-2017-3159 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
- Product
- Apache Camel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orgopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.