https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T06:11:40.134819+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-233397 EUVD-2026-233397 2026-10-03T06:11:40.198455+00:00 EUVD-2026-233397 https://cve.radiocsirt.org/vuln/fkie_cve-2022-41922 fkie_cve-2022-41922 2026-10-03T06:11:40.198495+00:00

`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has been patched in 1.1.27.

 https://cve.radiocsirt.org/vuln/ghsa-442f-wcwq-fpcf GHSA-442f-wcwq-fpcf — Prevent RCE when deserializing untrusted user input 2026-10-03T06:11:40.198529+00:00

Affected: Packagist: yiisoft/yii

### Impact Affected versions of `yiisoft/yii` are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input.

### Patches Upgrade `yiisoft/yii` to version 1.1.27 or higher.

### For more information See the following links for more details: - [Git commit](https://github.com/yiisoft/yii/commit/ed67b7cc57216557c5c595c6650cdd2d3aa41c52) - https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection

If you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).

 https://cve.radiocsirt.org/vuln/gsd-2022-41922 gsd-2022-41922 2026-10-03T06:11:40.198559+00:00 gsd-2022-41922