Yiisoft Yii2 vulnerabilities

• yiisoft yii2 Yii 2: Local file inclusion via view parameter name collision CVE-2026-39850 Fix available 7.4 HighMay 11, 2026
• yiiframework yii2-redis Yii 2 Redis may expose AUTH paramters in logs in case of connection failure CVE-2025-48493 Fix available 5.1 MediumJune 5, 2025
• yiiframework yii, yiisoft yii2 +1 more yiisoft Yii2 MockClass.php generate deserialization CVE-2025-2690 5.3 MediumMarch 24, 2025
• yiiframework yii, yiisoft yii2 +1 more yiisoft Yii2 SortableIterator.php getIterator deserialization CVE-2025-2689 5.3 MediumMarch 24, 2025
• yiiframework yii, yiisoft yiisoft/yii2 +1 more Unsafe Reflection in base Component class in yiisoft/yii2 CVE-2024-4990 Fix available EPSS 80.1% 8.1 HighJune 2, 2024
• yiiframework yii, yiisoft yii2 +1 more Reflected Cross-site Scripting in yiisoft/yii2 Debug mode CVE-2024-32877 Fix available 4.2 MediumMay 30, 2024
• yiiframework yii2-authclient yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation CVE-2023-50708 Fix available 6.1 MediumDecember 18, 2023
• yiiframework yii2-authclient The Oauth2 PKCE implementation is vulnerable CVE-2023-50714 Fix available 6.8 MediumDecember 18, 2023
• yiiframework yii, yiisoft yiisoft/yii2 +1 more Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 CVE-2021-3692 Fix available 8.1 HighAugust 10, 2021
• yiiframework yii, yiisoft yiisoft/yii2 +1 more Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 CVE-2021-3689 Fix available 8.1 HighAugust 10, 2021
• yiiframework yii, yiisoft yii2 +1 more Unsafe deserialization in Yii 2 CVE-2020-15148 Public exploitFix available EPSS 77.5% 8.9 HighSeptember 15, 2020