yiisoft vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20212
3. 20221
4. 20233
5. 20241
6. 20255
7. 20261

Newest CVEs

• CVE-2026-39850

  Yii 2: Local file inclusion via view parameter name collision

  yiisoft · yii2

  High7.4
• CVE-2025-48493

  Yii 2 Redis may expose AUTH paramters in logs in case of connection failure

  yiisoft · yii2-redis

  Medium5.1
• CVE-2025-32027

  Yii does not prevent XSS in scenarios where fallback error renderer is used

  yiisoft · yii

  Medium6.1
• CVE-2025-2690

  yiisoft Yii2 MockClass.php generate deserialization

  yiisoft · Yii2

  Medium5.3
• CVE-2025-2689

  yiisoft Yii2 SortableIterator.php getIterator deserialization

  yiisoft · Yii2

  Medium5.3
• CVE-2024-4990

  Unsafe Reflection in base Component class in yiisoft/yii2

  yiisoft · yiisoft/yii2

  High8.1
• CVE-2024-32877

  Reflected Cross-site Scripting in yiisoft/yii2 Debug mode

  yiisoft · yii2

  Medium4.2
• CVE-2023-50714

  The Oauth2 PKCE implementation is vulnerable

  yiisoft · yii2-authclient

  Medium6.8
• CVE-2023-50708

  yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

  yiisoft · yii2-authclient

  Medium6.1
• CVE-2023-47130

  Unsafe deserialization of user data in yiisoft/yii

  yiisoft · yii

  High8.1