yahoo
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| serialize-javascript | 4 | – | Oct 23, 2026 |
| elide | 3 | – | Jun 29, 2026 |
| CMAK | 2 | – | Sep 16, 2026 |
Exploited and recent CVEs
- CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body 0.3%
- CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body 0.2%
- CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies 0.3%
- CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes 0.4%
- CVE-2026-92751 CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter 0.3%
- CVE-2026-57954 Elide 7.1.17 - Permission Bypass in Sort Expression Validation 0.2%
- CVE-2026-34043 Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects 0.5%
- CVE-2022-24827 SQL Injection in elide-datastore-aggregation 1.4%
- CVE-2020-5289 Read permissions not enforced for client provided filter expressions in Elide http client 1.3%