github.com/yewstack/yew
Submitted 8/4/2026, 10:28:02 AM · Status: ok
Risk grade
F
100 / 100
Findings
311
0 critical7 high62 medium4 low238 info0 on CISA KEV0ATT&CK
Showing 311 of 311 findings
Findings
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassemblygrype
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()grype
- brace-expansion through 5.0.7 is vulnerable to denial of service via m ...brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps…trivyCVE-2026-14257
- Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly## Summary The `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be sensitive to p…trivy
- Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A simi…trivy
This report is public.