Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
OESA-2026-3237 (CVE-2026-63676)
Vulnerability from osv_openeuler – Published: 2026-08-07 09:13 – Updated: 2026-08-07 09:13 – Source website
VLAI
Summary
perl-YAML security update
Details
The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.
Security Fix(es):
The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)
Severity
5.4 (Medium)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"noarch": [
"perl-YAML-1.26-7.oe2003sp4.noarch.rpm",
"perl-YAML-help-1.26-7.oe2003sp4.noarch.rpm"
],
"src": [
"perl-YAML-1.26-7.oe2003sp4.src.rpm"
]
},
"package": {
"ecosystem": "openEuler:20.03-LTS-SP4",
"name": "perl-YAML",
"purl": "pkg:rpm/openEuler/perl-YAML\u0026distro=openEuler-20.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.26-7.oe2003sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Low"
},
"details": "The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)",
"id": "OESA-2026-3237",
"modified": "2026-08-07T09:13:13Z",
"published": "2026-08-07T09:13:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3237"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63676"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "perl-YAML security update",
"upstream": [
"CVE-2026-63676"
]
}
OESA-2026-3238 (CVE-2026-63676)
Vulnerability from osv_openeuler – Published: 2026-08-07 09:17 – Updated: 2026-08-07 09:17 – Source website
VLAI
Summary
perl-YAML security update
Details
The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.
Security Fix(es):
The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)
Severity
5.4 (Medium)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"noarch": [
"perl-YAML-1.321-1.oe2403sp1.noarch.rpm",
"perl-YAML-help-1.321-1.oe2403sp1.noarch.rpm"
],
"src": [
"perl-YAML-1.321-1.oe2403sp1.src.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP1",
"name": "perl-YAML",
"purl": "pkg:rpm/openEuler/perl-YAML\u0026distro=openEuler-24.03-LTS-SP1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.321-1.oe2403sp1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Low"
},
"details": "The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)",
"id": "OESA-2026-3238",
"modified": "2026-08-07T09:17:00Z",
"published": "2026-08-07T09:17:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3238"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63676"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "perl-YAML security update",
"upstream": [
"CVE-2026-63676"
]
}
OESA-2026-3239 (CVE-2026-63676)
Vulnerability from osv_openeuler – Published: 2026-08-07 09:19 – Updated: 2026-08-07 09:19 – Source website
VLAI
Summary
perl-YAML security update
Details
The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.
Security Fix(es):
The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)
Severity
5.4 (Medium)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"noarch": [
"perl-YAML-1.321-1.oe2403sp3.noarch.rpm",
"perl-YAML-help-1.321-1.oe2403sp3.noarch.rpm"
],
"src": [
"perl-YAML-1.321-1.oe2403sp3.src.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP3",
"name": "perl-YAML",
"purl": "pkg:rpm/openEuler/perl-YAML\u0026distro=openEuler-24.03-LTS-SP3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.321-1.oe2403sp3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Low"
},
"details": "The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)",
"id": "OESA-2026-3239",
"modified": "2026-08-07T09:19:43Z",
"published": "2026-08-07T09:19:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3239"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63676"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "perl-YAML security update",
"upstream": [
"CVE-2026-63676"
]
}
OESA-2026-3240 (CVE-2026-63676)
Vulnerability from osv_openeuler – Published: 2026-08-07 09:23 – Updated: 2026-08-07 09:23 – Source website
VLAI
Summary
perl-YAML security update
Details
The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.
Security Fix(es):
The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)
Severity
5.4 (Medium)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"noarch": [
"perl-YAML-1.321-1.oe2403sp4.noarch.rpm",
"perl-YAML-help-1.321-1.oe2403sp4.noarch.rpm"
],
"src": [
"perl-YAML-1.321-1.oe2403sp4.src.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP4",
"name": "perl-YAML",
"purl": "pkg:rpm/openEuler/perl-YAML\u0026distro=openEuler-24.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.321-1.oe2403sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Low"
},
"details": "The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\n\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)",
"id": "OESA-2026-3240",
"modified": "2026-08-07T09:23:03Z",
"published": "2026-08-07T09:23:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3240"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63676"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "perl-YAML security update",
"upstream": [
"CVE-2026-63676"
]
}
OESA-2026-3406 (CVE-2026-63676)
Vulnerability from osv_openeuler – Published: 2026-08-20 09:54 – Updated: 2026-08-20 09:54 – Source website
VLAI
Summary
perl-YAML security update
Details
The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.
Security Fix(es):
The MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)
Severity
5.4 (Medium)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"noarch": [
"perl-YAML-1.321-1.oe2203sp4.noarch.rpm",
"perl-YAML-help-1.321-1.oe2203sp4.noarch.rpm"
],
"src": [
"perl-YAML-1.321-1.oe2203sp4.src.rpm"
]
},
"package": {
"ecosystem": "openEuler:22.03-LTS-SP4",
"name": "perl-YAML",
"purl": "pkg:rpm/openEuler/perl-YAML\u0026distro=openEuler-22.03-LTS-SP4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.321-1.oe2203sp4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. (Including Perl!!!) For information on the YAML syntax, please refer to the YAML specification.\r\n\r\nSecurity Fix(es):\n\nThe MPG WordPress plugin prior to 4.1.8 does not sanitize and escape parameters before reflecting them back into the response, allowing an unauthenticated attacker to perform reflected cross-site scripting against a victim who is induced to send a crafted request.(CVE-2026-63676)",
"id": "OESA-2026-3406",
"modified": "2026-08-20T09:54:32Z",
"published": "2026-08-20T09:54:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3406"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63676"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "perl-YAML security update",
"upstream": [
"CVE-2026-63676"
]
}
OPENSUSE-SU-2026:11321-1
Vulnerability from csaf_opensuse - Published: 2026-07-21 00:00 - Updated: 2026-09-17 17:15Summary
perl-YAML-1.320.0-1.1 on GA media
Severity
Moderate
Scope
1 vulnerability in this advisory, including CVE-2026-63676.
CVE-2026-63676
Recommended: 4 products
UBUNTU-CVE-2026-63676 (CVE-2026-63676)
Vulnerability from osv_ubuntu – Published: 2026-08-27 00:00 – Updated: 2026-10-14 09:12 – Source website
VLAI
Details
backtracking leading to exponential load time
Severity
N/A (UNKNOWN)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "libyaml-perl",
"binary_version": "1.15-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "libyaml-perl",
"purl": "pkg:deb/ubuntu/libyaml-perl@1.15-1ubuntu0.1~esm1?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15-1ubuntu0.1~esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.13-1",
"1.15-1"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "libyaml-perl",
"binary_version": "1.24-1ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "libyaml-perl",
"purl": "pkg:deb/ubuntu/libyaml-perl@1.24-1ubuntu0.1~esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24-1ubuntu0.1~esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.21-1",
"1.24-1"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "libyaml-perl",
"binary_version": "1.30-1ubuntu0.20.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "libyaml-perl",
"purl": "pkg:deb/ubuntu/libyaml-perl@1.30-1ubuntu0.20.04.1~esm1?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.30-1ubuntu0.20.04.1~esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.29-1",
"1.30-1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libyaml-perl",
"binary_version": "1.30-1ubuntu0.22.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "libyaml-perl",
"purl": "pkg:deb/ubuntu/libyaml-perl@1.30-1ubuntu0.22.04.1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.30-1ubuntu0.22.04.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.30-1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libyaml-perl",
"binary_version": "1.31-1ubuntu0.24.04.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "libyaml-perl",
"purl": "pkg:deb/ubuntu/libyaml-perl@1.31-1ubuntu0.24.04.1?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31-1ubuntu0.24.04.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.30-2",
"1.31-1"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "libyaml-perl",
"binary_version": "1.31-1ubuntu0.26.04.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:26.04:LTS",
"name": "libyaml-perl",
"purl": "pkg:deb/ubuntu/libyaml-perl@1.31-1ubuntu0.26.04.1~esm1?arch=source\u0026distro=esm-apps/resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31-1ubuntu0.26.04.1~esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.31-1"
]
}
],
"aliases": [],
"details": "backtracking leading to exponential load time",
"id": "UBUNTU-CVE-2026-63676",
"modified": "2026-10-14T09:12:11Z",
"published": "2026-08-27T00:00:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-63676"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63676"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8925-1"
}
],
"related": [
"USN-8925-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-63676"
]
}