https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T00:55:47.033267+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2019-14677 cnvd-2019-14677 2026-10-03T00:55:47.036733+00:00 cnvd-2019-14677 https://cve.radiocsirt.org/vuln/euvd-2026-65912 EUVD-2026-65912 2026-10-03T00:55:47.036764+00:00 EUVD-2026-65912 https://cve.radiocsirt.org/vuln/fkie_cve-2018-12556 fkie_cve-2018-12556 2026-10-03T00:55:47.036778+00:00

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.

 https://cve.radiocsirt.org/vuln/ghsa-8mxx-g9vw-r875 GHSA-8mxx-g9vw-r875 2026-10-03T00:55:47.036806+00:00

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.

 https://cve.radiocsirt.org/vuln/gsd-2018-12556 gsd-2018-12556 2026-10-03T00:55:47.036822+00:00 gsd-2018-12556 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-12556 UBUNTU-CVE-2018-12556 2026-10-03T00:55:47.036833+00:00

Affected: Ubuntu:20.04:LTS: node-yarnpkg, Ubuntu:22.04:LTS: node-yarnpkg, Ubuntu:24.04:LTS: node-yarnpkg, Ubuntu:25.10: node-yarnpkg, Ubuntu:26.04:LTS: node-yarnpkg

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.