Approved changes feed: RSS · Atom
cpe:2.3:a:yeti-platform:yeti:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Yeti Platform (4a4c1803-1603-5152-a15f-c6698ae64ad7) |
|---|---|
| Product | Yeti (c213c45c-9658-5018-ba65-3392f82e0ef7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/yeti-platform/yeti |
purl2cpe | 2026-06-01 10:18:20.375341 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-92783 |
vulnerable | 2026-10-13 12:28:53.665843 |
Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion
HIGH (8.1)
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.
Published: 2026-09-16T20:32:40.330Z
Updated: 2026-09-17T13:48:45.094Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46508 |
vulnerable | 2026-06-08 06:48:10.126027 |
Details available
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).
Published: 2026-05-08T00:00:00.000Z
Updated: 2026-05-08T18:24:44.897Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-46507 |
vulnerable | 2026-06-08 06:48:10.125655 |
Details available
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.
Published: 2026-05-08T00:00:00.000Z
Updated: 2026-05-08T17:40:42.362Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45412 |
vulnerable | 2026-06-08 06:48:06.094378 |
Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack
MEDIUM (5.3)
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.
Published: 2024-09-10T15:19:40.623Z
Updated: 2024-09-10T16:09:40.822Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.