yahoo has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 3.9 (low). Most affected products: CMAK (2), serialize-javascript (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 3.9
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-92751High· 8.1CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators57CVE-2026-92778Medium· 5.4CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate30CVE-2026-97711Low· 2.3Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions13CVE-2026-115897Low· 2.1Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body12
yahoo vulnerabilities
CVEs affecting yahoo, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-115897Low· 2.1⚖ disputedSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-in…
CVE-2026-97711Low· 2.3⚖ disputedSerialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-cl…
CVE-2026-92751High· 8.1PoCCMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints l…
CVE-2026-92778Medium· 5.4CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate
CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election schedul…