Yyiisoft

Products

Exploited and recent CVEs

• CVE-2026-39850 High 7.4 Yii 2: Local file inclusion via view parameter name collision 0.5%
• CVE-2025-48493 Medium 5.1 Yii 2 Redis may expose AUTH paramters in logs in case of connection failure 0.3%
• CVE-2025-32027 Medium 6.1 Yii does not prevent XSS in scenarios where fallback error renderer is used 0.2%
• CVE-2025-2690 Medium 6.3 yiisoft Yii2 MockClass.php generate deserialization 0.7%
• CVE-2025-2689 Medium 6.3 yiisoft Yii2 SortableIterator.php getIterator deserialization 0.6%
• CVE-2024-4990 High 8.1 Unsafe Reflection in base Component class in yiisoft/yii2 80.1%
• CVE-2024-32877 Medium 4.2 Reflected Cross-site Scripting in yiisoft/yii2 Debug mode 0.3%
• CVE-2023-50714 Medium 6.8 The Oauth2 PKCE implementation is vulnerable 0.5%
• CVE-2023-50708 Medium 6.1 yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation 0.7%
• CVE-2023-47130 High 8.1 Unsafe deserialization of user data in yiisoft/yii 3.1%
• CVE-2022-41922 High 8.1 yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input 1.2%
• CVE-2021-3692 High 8.1 Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 1.7%
• CVE-2021-3689 High 8.1 Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 1.9%
• CVE-2020-15148 High 8.9 Unsafe deserialization in Yii 2 77.5%