https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 00:55:11 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-14677 cnvd-2019-14677 https://cve.radiocsirt.org/vuln/cnvd-2019-14677 https://cve.radiocsirt.org/vuln/euvd-2026-65912 EUVD-2026-65912 https://cve.radiocsirt.org/vuln/euvd-2026-65912 https://cve.radiocsirt.org/vuln/fkie_cve-2018-12556 <p>The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.</p> <p>The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-12556 https://cve.radiocsirt.org/vuln/ghsa-8mxx-g9vw-r875 <p>The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.</p> <p>The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.</p> https://cve.radiocsirt.org/vuln/ghsa-8mxx-g9vw-r875 https://cve.radiocsirt.org/vuln/gsd-2018-12556 gsd-2018-12556 https://cve.radiocsirt.org/vuln/gsd-2018-12556 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-12556 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-yarnpkg, Ubuntu:22.04:LTS: node-yarnpkg, Ubuntu:24.04:LTS: node-yarnpkg, Ubuntu:25.10: node-yarnpkg, Ubuntu:26.04:LTS: node-yarnpkg</p> <p>The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-yarnpkg, Ubuntu:22.04:LTS: node-yarnpkg, Ubuntu:24.04:LTS: node-yarnpkg, Ubuntu:25.10: node-yarnpkg, Ubuntu:26.04:LTS: node-yarnpkg</p> <p>The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-12556