YA
Vendor
Yahoo
74
CVEs
0
On KEV
3
New 30D
Products
SE7.5
serialize-javascript
yahoo
4 CVEs0 on KEV3 new
ME–
Messenger
Yahoo
33 CVEs0 on KEV0 new
YU–
Yui
Yahoo
12 CVEs0 on KEV0 new
TO7.8
Toolbar
Yahoo
5 CVEs0 on KEV0 new
MJ–
Music Jukebox
Yahoo
3 CVEs0 on KEV0 new
YB–
Yahoo! Browser
Yahoo
3 CVEs0 on KEV0 new
CM8.1
CMAK
yahoo
2 CVEs0 on KEV0 new
AT6.1
Athenz
Yahoo
1 CVEs0 on KEV0 new
AC–
Audio Conferencing Activex Control
Yahoo
1 CVEs0 on KEV0 new
EL4.3
elide
yahoo
1 CVEs0 on KEV0 new
JS–
Japan Shopping
Yahoo
1 CVEs0 on KEV0 new
PA–
Pager
Yahoo
1 CVEs0 on KEV0 new
SE7.5
Serialize
Yahoo
1 CVEs0 on KEV0 new
TU–
Tumblr
Yahoo
1 CVEs0 on KEV0 new
UL–
UI Library
Yahoo
1 CVEs0 on KEV0 new
WI–
Widgets
Yahoo
1 CVEs0 on KEV0 new
YA–
Yafuoku!
Yahoo
1 CVEs0 on KEV0 new
YA–
Yahoo Assistant
Yahoo
1 CVEs0 on KEV0 new
YY–
Yahoo Ybox
Yahoo
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115897 New | SE serialize-javascript yahoo | 2.1 | Oct 23 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body |
| CVE-2026-115754 New | SE serialize-javascript yahoo | 4.7 | Oct 23 | serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body |
| CVE-2026-97711 | SE serialize-javascript yahoo | 2.3 | Sep 29 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies |
| CVE-2026-92778 | CM CMAK yahoo | 5.4 | Sep 16 | CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes |
| CVE-2026-92751 | CM CMAK yahoo | 8.1 | Sep 16 | CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter |
| CVE-2026-57954 | EL elide yahoo | 4.3 | Jun 29 | Elide 7.1.17 - Permission Bypass in Sort Expression Validation |
| CVE-2026-34043 | SE serialize-javascript yahoo | 7.5 | Mar 31 | Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects |
| CVE-2019-6035 | AT Athenz Yahoo | 6.1 | Dec 26 | Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted… |
| CVE-2017-2253 | TO Toolbar Yahoo | 7.8 | Jul 17 | Untrusted search path vulnerability in Installer of Yahoo! Toolbar (for Internet explorer) v8.0.0.6 and earlier, with its timestamp prior to June 13, 2017, 18:18:55 allows an… |
| CVE-2014-7216 | ME Messenger Yahoo | – | Sep 11 | Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code… |
| CVE-2014-5881 | YY Yahoo Ybox Yahoo | – | Sep 11 | The Yahoo! Japan Box (aka jp.co.yahoo.android.ybox) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to… |
| CVE-2013-6853 | TO Toolbar Yahoo | – | Jan 26 | Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac, and 2.5.9.2013418100420 for Windows, allows remote… |
| CVE-2013-6780 | YU Yui Yahoo | – | Nov 13 | Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML… |
| CVE-2013-4700 | JS Japan Shopping Yahoo | – | Aug 21 | The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers… |
| CVE-2013-4699 | YA Yafuoku! Yahoo | – | Aug 21 | The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
| CVE-2013-4942 | YU Yui Yahoo | – | Jul 29 | Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11,… |
| CVE-2013-4941 | YU Yui Yahoo | – | Jul 29 | Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x… |
| CVE-2013-4940 | YU Yui Yahoo | – | Jul 29 | Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8,… |
| CVE-2013-4939 | YU Yui Yahoo | – | Jul 29 | Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x… |
| CVE-2013-4873 | TU Tumblr Yahoo | – | Jul 18 | The Yahoo! Tumblr app before 3.4.1 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network |
| CVE-2013-2316 | YB Yahoo! Browser Yahoo | – | Jun 3 | The Yahoo! Browser application 1.4.4 and earlier for Android allows remote attackers to spoof the address bar via vectors related to URL display, a different vulnerability than… |
| CVE-2013-2307 | YB Yahoo! Browser Yahoo | – | Apr 26 | The Yahoo! Browser application before 1.4.3 for Android allows remote attackers to spoof the address bar via a crafted web site |
| CVE-2012-5883 | YU Yui Yahoo | – | Nov 16 | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before… |
| CVE-2012-5882 | YU Yui Yahoo | – | Nov 16 | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via… |
| CVE-2012-5881 | YU Yui Yahoo | – | Nov 16 | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via… |
| CVE-2012-2647 | TO Toolbar Yahoo | – | Jul 31 | Yahoo! Toolbar 1.0.0.5 and earlier for Chrome and Safari allows remote attackers to modify the configured search URL, and intercept search terms, via a crafted web page |
| CVE-2012-2645 | YB Yahoo! Browser Yahoo | – | Jul 16 | The Yahoo! Japan Yahoo! Browser application 1.2.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive… |
| CVE-2012-0268 | ME Messenger Yahoo | – | Jan 19 | Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute… |
| CVE-2010-4710 | YU Yui Yahoo | – | Jan 28 | Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field… |
| CVE-2010-4208 | YU Yui Yahoo | – | Nov 7 | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers… |
| CVE-2010-4209 | YU Yui Yahoo | – | Nov 7 | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.8.1, as used in Bugzilla 3.7.1 through 3.7.3 and 4.1, allows remote attackers… |
| CVE-2010-4207 | YU Yui Yahoo | – | Nov 7 | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers… |
| CVE-2009-4171 | ME Messenger Yahoo | – | Dec 2 | An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remote attackers to cause a denial of service (NULL pointer… |
| CVE-2008-2111 | YA Yahoo Assistant Yahoo | – | May 7 | The ActiveX Control (yNotifier.dll) in Yahoo! Assistant 3.6 and earlier allows remote attackers to execute arbitrary code via unspecified vectors in the Ynoifier COM object that… |
| CVE-2008-0624 | MJ Music Jukebox Yahoo | – | Feb 6 | Buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! JukeBox 2.2.2.56 allows remote attackers to execute arbitrary code via a long argument to the… |
| CVE-2008-0625 | MJ Music Jukebox Yahoo | – | Feb 6 | Buffer overflow in the MediaGrid ActiveX control (mediagrid.dll) in Yahoo! Music Jukebox 2.2.2.56 allows remote attackers to execute arbitrary code via a long argument to the… |
| CVE-2008-0623 | MJ Music Jukebox Yahoo | – | Feb 6 | Stack-based buffer overflow in the YMP Datagrid ActiveX control (datagrid.dll) in Yahoo! Music Jukebox 2.2.2.056 allows remote attackers to execute arbitrary code via a long… |
| CVE-2007-6535 | TO Toolbar Yahoo | – | Dec 27 | Buffer overflow in the YShortcut ActiveX control in YShortcut.dll 2006.8.15.1 in Yahoo! Toolbar might allow attackers to execute arbitrary code via a long string to the IsTaggedBM… |
| CVE-2007-6228 | TO Toolbar Yahoo | – | Dec 4 | Stack-based buffer overflow in the Helper class in the yt.ythelper.2 ActiveX control in Yahoo! Toolbar 1.4.1 allows remote attackers to cause a denial of service (browser crash)… |
| CVE-2007-5017 | ME Messenger Yahoo | – | Sep 20 | Absolute path traversal vulnerability in a certain ActiveX control in the CYFT object in ft60.dll in Yahoo! Messenger 8.1.0.421 allows remote attackers to force a download, and… |
| CVE-2007-4635 | ME Messenger Yahoo | – | Aug 31 | Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer… |
| CVE-2007-4515 | ME Messenger Yahoo | – | Aug 31 | Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to… |
| CVE-2007-4391 | ME Messenger Yahoo | – | Aug 17 | Heap-based buffer overflow in Kakadu kdu_v32m.dll in Yahoo! Messenger 8.1.0.413 allows remote attackers to cause a denial of service (application crash) via a certain length field… |
| CVE-2007-4034 | WI Widgets Yahoo | – | Jul 27 | Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets… |
| CVE-2007-3928 | ME Messenger Yahoo | – | Jul 21 | Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users to execute arbitrary code via a long e-mail address in an address book entry |
| CVE-2007-3638 | ME Messenger Yahoo | – | Jul 10 | Buffer overflow in Yahoo! Messenger 8.1 allows user-assisted remote authenticated users, who are listed in an address book, to execute arbitrary code via unspecified vectors, aka… |
| CVE-2007-3148 | ME Messenger Yahoo | – | Jun 11 | Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long… |
| CVE-2007-3147 | ME Messenger Yahoo | – | Jun 11 | Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to execute arbitrary code via a long… |
| CVE-2007-2385 | UL UI Library Yahoo | – | Apr 30 | The Yahoo! UI framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web… |
| CVE-2007-1680 | ME Messenger Yahoo | – | Apr 6 | Stack-based buffer overflow in the createAndJoinConference function in the AudioConf ActiveX control (yacscom.dll) in Yahoo! Messenger before 20070313 allows remote attackers to… |
| CVE-2007-0868 | ME Messenger Yahoo | – | Feb 9 | Unspecified vulnerability in the Chat Room functionality in Yahoo! Messenger 8.1.0.239 and earlier allows remote attackers to cause a denial of service via unspecified vectors |
| CVE-2007-0768 | ME Messenger Yahoo | – | Feb 6 | Multiple cross-site scripting (XSS) vulnerabilities in the Contact Details functionality in Yahoo! Messenger 8.1.0.209 and earlier allow user-assisted remote attackers to inject… |
| CVE-2006-6603 | ME Messenger Yahoo | – | Dec 15 | Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) before 2005.1.1.4 in Yahoo! Messenger allows remote attackers to execute arbitrary code via a crafted HTML… |
| CVE-2006-5563 | ME Messenger Yahoo | – | Oct 27 | Unspecified vulnerability in Yahoo! Messenger (Service 18) before 8.1.0.195 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a… |
| CVE-2006-4975 | ME Messenger Yahoo | – | Sep 25 | Yahoo! Messenger for WAP permits saving messages that contain JavaScript, which allows user-assisted remote attackers to inject arbitrary web script or HTML via a URL at the… |
| CVE-2006-3298 | ME Messenger Yahoo | – | Jun 29 | Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service (crash) via messages that contain non-ASCII characters, which triggers the crash in… |
| CVE-2005-1671 | ME Messenger Yahoo | – | May 19 | The Logfile feature in Yahoo! Messenger 5.x through 6.0 can be activated by a YMSGR: URL and writes all output to a single ypager.log file, even when there are multiple users, and… |
| CVE-2005-1618 | ME Messenger Yahoo | – | May 16 | The YMSGR URL handler in Yahoo! Messenger 5.x through 6.0 allows remote attackers to cause a denial of service (disconnect) via a room login or a room join request packet with a… |
| CVE-2005-0737 | ME Messenger Yahoo | – | May 2 | Buffer overflow in Yahoo! Messenger allows remote attackers to execute arbitrary code via the offline mode |
| CVE-2005-0242 | ME Messenger Yahoo | – | Feb 18 | The Audio Setup Wizard (asw.dll) in Yahoo! Messenger 6.0.0.1750, and possibly other versions, allows attackers to arbitrary code by placing a malicious ping.exe program into the… |