Ymfe vulnerabilities
We track 3 vulnerabilities in Ymfe products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 9, 2026.
Latest Ymfe vulnerabilities
- 7.5 High severity
Yapi: Uncontrolled Resource Consumption
An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service.
- 7.4 High severity
Yapi: Improper Certificate Validation
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in the HTTPS agent configuration for Axios requests
- 7.4 High severity
yapi: Improper Neutralization of Script-Related HTML Tags in a Web Page
A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field.