nuget

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 6.5MediumNov 11, 2026nuget Microsoft.TestPlatform.CLI Auth bypass / access controlISSUE-GHSA685687hxp5x7## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. The VSTest artifact postprocessor can consume a forged `executionComplete.json` from another local user and execute attacker-controlled output handling. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/517 ## CVSS Details - **Version
• 7.3HighNov 10, 2026nuget Aspire.Cli Information disclosureISSUE-GHSAfgfw85w4gx99## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references. ## Original Description Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.
• 7.3HighNov 10, 2026nuget Aspire.Cli Privilege escalationISSUE-GHSAhfpm4fc4g2wc## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references. ## Original Description Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.
• 7.5HighNov 10, 2026nuget Microsoft.AspNetCore.App.Runtime.win-arm64ISSUE-GHSA95x67hq82c37## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references. ## Original Description Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
• 7.5HighNov 10, 2026nuget Microsoft.AspNetCore.Server.HttpSys Denial of serviceISSUE-GHSA49q5vjx75gwr## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references. ## Original Description Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• 7.5HighNov 10, 2026nuget Microsoft.AspNetCore.SignalR.StackExchangeRedis Denial of serviceISSUE-GHSAgxg85rwfcg43## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references. ## Original Description Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• 6.5MediumNov 10, 2026nuget Microsoft.AspNetCore.App.Runtime.linux-armISSUE-GHSAc827j3xf67v6## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8w29-6cjc-h6w4. This link is maintained to preserve external references. ## Original Description Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
• 5.3MediumNov 10, 2026nuget Microsoft.NETCore.App.Runtime.linux-armCVE-2026-120796Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• 7.5HighNov 10, 2026nuget Aspire.Hosting.AppHost Information disclosureCVE-2026-120006## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components. Disclosure of an Aspire Dashboard authentication cookie to a linked service can allow an attacker-controlled container to replay the authenticated session and execute code as the host developer. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announceme
• 6.5MediumNov 10, 2026nuget Microsoft.AspNetCore.WebUtilities Denial of serviceCVE-2026-118750## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. FileBufferingReadStream buffer allocation can allow unauthenticated multipart-form requests to exhaust memory. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/512 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **S
• 6.5MediumNov 10, 2026nuget Microsoft.AspNetCore.App.Runtime.linux-armCVE-2026-118749## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issu
• 6.5MediumNov 10, 2026nuget System.Formats.CborCVE-2026-118747## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Colliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/501 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score)
• 5.9MediumNov 10, 2026nuget Microsoft.NETCore.App.Runtime.linux-armCVE-2026-118746## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Unix Negotiate authentication can accept a request when required channel-binding information is missing. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/498 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 6.8
• 6.5MediumNov 10, 2026nuget Microsoft.DotNet.HotReload.Watch.AspireCVE-2026-114155## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations. A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it. ## An
• 7.5HighNov 10, 2026nuget Microsoft.AspNetCore.App.Runtime.linux-arm Denial of serviceCVE-2026-114149## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume excessive resources. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:**
• 8.1HighNov 3, 2026nuget Microsoft.DotNet.ILCompiler Memory corruptionISSUE-GHSAp3jp9v8376w9## Executive summary A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations. Applications are exposed when they enable Brotli decompression or explicitly use Brotli decompression
• 5.5MediumOct 28, 2026nuget MySqlConnector Information disclosureISSUE-GHSA473qm89cghf8## Summary With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the password to validate a self-signed cert, e.g., MariaDB's [zero-configuration TLS](https://mariadb.com/docs/server/security/encryption/data-in-transit-encryption/zero-configuration-ssl). ## Impact An attacker who can deploy a man-in-the-middle

See every nuget entry on the dashboard.

Top products

• Microsoft.AspNetCore.App.Runtime.linux-arm3 CVEs in the last year
• Microsoft.NETCore.App.Runtime.linux-arm2 CVEs in the last year
• Aspire.Cli2 CVEs in the last year
• System.Formats.Cbor1 CVE in the last year
• MySqlConnector1 CVE in the last year
• Microsoft.TestPlatform.CLI1 CVE in the last year
• Microsoft.DotNet.ILCompiler1 CVE in the last year
• Microsoft.DotNet.HotReload.Watch.Aspire1 CVE in the last year
• Microsoft.AspNetCore.WebUtilities1 CVE in the last year
• Microsoft.AspNetCore.SignalR.StackExchangeRedis1 CVE in the last year