https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:08:07.572878+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-17487 cnvd-2020-17487 2026-10-03T09:08:07.652730+00:00 cnvd-2020-17487 https://cve.radiocsirt.org/vuln/euvd-2026-57214 EUVD-2026-57214 2026-10-03T09:08:07.652768+00:00 EUVD-2026-57214 https://cve.radiocsirt.org/vuln/fkie_cve-2019-15608 fkie_cve-2019-15608 2026-10-03T09:08:07.652782+00:00

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

 https://cve.radiocsirt.org/vuln/ghsa-hjxc-462x-x77j GHSA-hjxc-462x-x77j — TOCTOU Race Condition in Yarn 2026-10-03T09:08:07.652812+00:00

Affected: npm: yarn

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.

 https://cve.radiocsirt.org/vuln/gsd-2019-15608 gsd-2019-15608 2026-10-03T09:08:07.652836+00:00 gsd-2019-15608 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-15608 Withdrawn: UBUNTU-CVE-2019-15608 2026-10-03T09:08:07.652848+00:00

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: node-yarnpkg

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.