Veille CVE

Recherche « Yeti-platform yeti »

3 CVE

Critique 0 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Yeti-platform yeti » ✕
  1. CVE-2026-92783 8.1 Élevée

    yeti-platform yeti

    Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.

  2. CVE-2024-46508 7.5 Élevée

    Yeti-platform yeti

    yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).

  3. CVE-2024-46507 7.3 Élevée

    Yeti-platform yeti

    A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.