YI
Vendor
yiisoft
13
CVEs
0
On KEV
0
New 30D
Products
YI9.8
yii2
yiisoft
4 CVEs0 on KEV0 new
YI9.8
yii
yiisoft
3 CVEs0 on KEV0 new
YI9.1
yiisoft/yii2
yiisoft
3 CVEs0 on KEV0 new
YI9.8
yii2-authclient
yiisoft
2 CVEs0 on KEV0 new
YI6.5
yii2-redis
yiisoft
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-39850 | YI yii2 yiisoft | 7.4 | May 20 | Yii 2: Local file inclusion via view parameter name collision |
| CVE-2025-48493 | YI yii2-redis yiisoft | 6.5 | Jun 5 | Yii 2 Redis may expose AUTH paramters in logs in case of connection failure |
| CVE-2025-32027 | YI yii yiisoft | 6.1 | Apr 10 | Yii does not prevent XSS in scenarios where fallback error renderer is used |
| CVE-2025-2690 | YI Yii2 yiisoft | 9.8 | Mar 24 | yiisoft Yii2 MockClass.php generate deserialization |
| CVE-2025-2689 | YI Yii2 yiisoft | 9.8 | Mar 24 | yiisoft Yii2 SortableIterator.php getIterator deserialization |
| CVE-2024-4990 | YI yiisoft/yii2 yiisoft | 9.1 | Mar 20 | Unsafe Reflection in base Component class in yiisoft/yii2 |
| CVE-2024-32877 | YI yii2 yiisoft | 4.7 | May 30 | Reflected Cross-site Scripting in yiisoft/yii2 Debug mode |
| CVE-2023-50714 | YI yii2-authclient yiisoft | 8.8 | Dec 22 | The Oauth2 PKCE implementation is vulnerable |
| CVE-2023-50708 | YI yii2-authclient yiisoft | 9.8 | Dec 22 | yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation |
| CVE-2023-47130 | YI yii yiisoft | 9.8 | Nov 14 | Unsafe deserialization of user data in yiisoft/yii |
| CVE-2022-41922 | YI yii yiisoft | 9.8 | Nov 23 | yiisoft/yii before v1.1.27 vulnerable to Remote Code Execution if the application calls `unserialize()` on arbitrary user input |
| CVE-2021-3692 | YI yiisoft/yii2 yiisoft | 5.3 | Aug 10 | Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 |
| CVE-2021-3689 | YI yiisoft/yii2 yiisoft | 7.5 | Aug 10 | Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 |