Vendor
Ingydotnet
Products
2
CVEs
3
Across products
4
Status
Private
Products
2- 3 CVEs
- 1 CVE
Recent CVEs
3| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-20285 | Cri | 0.52 | 9.1 | 0.00 | Oct 5, 2026 | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What… | ||
| CVE-2019-25777 | Hig | 0.40 | 7.3 | 0.00 | Oct 5, 2026 | YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the… | ||
| CVE-2025-40908 | Cri | 0.00 | 9.1 | 0.00 | Jun 1, 2025 | YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified |
- risk 0.52cvss 9.1epss 0.00
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What…
- risk 0.40cvss 7.3epss 0.00
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the…
- risk 0.00cvss 9.1epss 0.00
YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified