Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Ymfe

First CVE: Sep 28, 2018Active for: 8 yearsTotal CVEs: 6

Ymfe maintains YApi, a niche API management and documentation platform, whose vulnerability footprint centers on web application input handling and cryptographic validation concerns. The recurring weakness classes—cross-site scripting, improper certificate validation, uncontrolled resource consumption, and insufficient random value generation—reflect typical challenges in web-facing platforms that handle user input and establish secure connections. Current severity, exploitation, and exposure figures are shown alongside this summary.

FAUCET AI Generated
6
Total CVEs
More Total CVEs than 86% of tracked vendors
1.5
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 76% of tracked vendors
6.0
Avg CVSS Score
Higher Avg CVSS Score than 29% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Ymfe over time

Volume of CVEsAvg CVSS Base Score
First CVE
Sep 28, 2018
7 years ago
Most Recent CVE
Mar 9, 2026
137 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (6 CVEs).

6 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2025-70059HIGH
An issue pertaining to CWE-400: Uncontrolled Resource Consumption was discovered in YMFE yapi v1.12.0 and allows attackers to cause a denial of service.
Mar 9, 20267.525NONO
CVE-2025-70058HIGH
An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL certificate validation by setting 'rejectUnaut
Feb 23, 20267.425NONO
CVE-2021-36686MEDIUM
Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
Jan 26, 20235.420NONO
CVE-2025-70060MEDIUM
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.
Mar 9, 20265.419NONO
CVE-2018-17574MEDIUM
An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
Sep 28, 20185.419NONO
CVE-2021-27884MEDIUM
Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used.
Mar 1, 20215.118NONO
View all 6 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products6 CVEs
67%
33%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local1 (16.7%)
Network5 (83.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low5 (83.3%)
High1 (16.7%)
Unknown0 (0.0%)
User Interaction
None3 (50.0%)
Unknown0 (0.0%)
Required3 (50.0%)
Privileges Required
Low2 (33.3%)
High0 (0.0%)
None4 (66.7%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (6 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Ymfe.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Ymfe — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Ymfe's Products

View all 1 CNAs →

Top CWEs