Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 14.10.2026

CVE-2026-62847

Metalama permite la ejecución local de código mediante la colocación de DLLs en directorios temporales compartidos

En Metalama para Linux y macOS, usuarios locales pueden plantar archivos DLL en directorios temporales compartidos para ejecutar código con los permisos de otros usuarios que inicien compilaciones.

.NET (NuGet)

metalama.framework, metalama.tool

Media 24.07.2026

CVE-2026-73851

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

.NET (NuGet)

microsoft.openapi.kiota

Alta 15.07.2026

CVE-2026-50273

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

.NET (NuGet)

datadog.trace, datadog.trace.opentracing

Media 02.07.2026

CVE-2026-50267

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

.NET (NuGet)

steeltoe.configuration.abstractions

Media 25.06.2026

CVE-2026-48513

MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

.NET (NuGet)

messagepack

Alta 25.06.2026

CVE-2026-48506

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

.NET (NuGet)

messagepack

Media 16.06.2026

CVE-2026-45491

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

.NET (NuGet)

microsoft.netcore.app.runtime.linux-x64, microsoft.netcore.app.runtime.osx-arm64, microsoft.netcore.app.runtime.win-x64

Alta 05.06.2026

CVE-2026-47761

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Composer npm .NET (NuGet)

tinymce/tinymce, tinymce

Alta 05.06.2026

CVE-2026-47762

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

Composer npm .NET (NuGet)

tinymce/tinymce, tinymce

Alta 05.06.2026

CVE-2026-47759

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

Composer npm .NET (NuGet)

tinymce/tinymce, tinymce

Media 29.05.2026

ghsa-qjvr-435c-5fjh

Nerdbank.MessagePack has a memory amplification DoS in collection deserialization

.NET (NuGet)

nerdbank.messagepack

Media 11.05.2026

ghsa-88q9-cmp2-c2vq

oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)

.NET (NuGet) Python (PyPI)

oxidizepdf.net, oxidize-pdf

Media 08.05.2026

CVE-2026-44788

SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)

.NET (NuGet)

sharpcompress

Alta 07.05.2026

CVE-2026-44503

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Java / Kotlin (Maven) npm .NET (NuGet) Python (PyPI)

com.microsoft.kiota:microsoft-kiota-abstractions, kiota-typescript, microsoft.kiota.abstractions +1

Alta 06.05.2026

CVE-2026-44302

Snappier has an infinite loop during SnappyStream decompression with malformed framed input

.NET (NuGet)

snappier

Alta 05.05.2026

CVE-2026-43937

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

.NET (NuGet)

yafnet.core

Alta 05.05.2026

CVE-2026-43938

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

.NET (NuGet)

yafnet.core

Media 30.04.2026

CVE-2026-42191

OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter

.NET (NuGet)

opentelemetry.exporter.opentelemetryprotocol

Media 23.04.2026

CVE-2026-40894

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

.NET (NuGet)

opentelemetry.api, opentelemetry.extensions.propagators

Media 23.04.2026

CVE-2026-40891

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

.NET (NuGet)

opentelemetry.exporter.opentelemetryprotocol

Media 22.04.2026

CVE-2026-41511

OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

.NET (NuGet)

openmcdf

Alta 16.04.2026

ghsa-f5v8-v6q3-q4h6

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

.NET (NuGet)

meridian.mapping, meridian.mediator

Media 24.03.2026

CVE-2026-74786

Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString

.NET (NuGet)

scriban, scriban.signed

Alta 27.02.2026

CVE-2026-27449

Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

.NET (NuGet)

umbraco.engage.forms