Medium
CVE-2026-92707
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 529
Reset filters
Medium
ghsa-86xp-94pg-8r6r
Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability
Medium
CVE-2026-70196
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability
Medium
CVE-2026-70194
Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability
Medium
CVE-2026-70162
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability
High
CVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
A denial-of-service vulnerability in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows crafted YAML OpenAPI documents with nested anchors and aliases to cause excessive memory consumption and crash the parsing process.
Medium
CVE-2026-62847
Metalama allows local code execution through DLL planting in shared temporary directories
Metalama on Linux and macOS trusts files in shared temporary directories without integrity checks, allowing local users to execute arbitrary code with the privileges of other users running builds.
Critical
CVE-2026-88092
Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability
A security feature bypass vulnerability in ASP.NET Core Kestrel allows aborted connections to reparse unread request-body bytes as new requests. This can lead to HTTP request smuggling or desynchronization attacks.
Medium
CVE-2026-96229
Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability
An information disclosure vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) affects .NET applications on Windows. Applications using vulnerable runtime packages may expose sensitive information through unsafe XAML and XPS operations.
Medium
CVE-2026-96234
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability
A vulnerability in Microsoft WindowsDesktop App Runtime (WPF) can lead to information disclosure through improper origin validation. Developers should update affected packages and .NET installations to mitigate the issue.
High
CVE-2026-96225
Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability
A vulnerability in .NET Core App Runtime and System.Private.CoreLib on Linux and macOS allows local attackers to manipulate Unix named-mutex and shared-memory paths to overwrite files, widen permissions, or elevate privileges.
Medium
CVE-2026-66822
Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability
A vulnerability in System.Net.Http allows SocketsHttpHandler to retain proxy authorization headers during an HTTP redirect. This can lead to information disclosure by leaking basic proxy credentials to the destination server.
High
CVE-2026-96224
Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability
A vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows crafted pixel-shader bytecode to cause heap out-of-bounds writes or reads, potentially leading to remote code execution.
High
CVE-2026-87697
Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability in Microsoft WindowsDesktop App Runtime allows attacker-controlled content to be reached via WPF XPS synthetic hyperlinks exposed through UI Automation. Successful exploitation requires user interaction and affects supported .NET applications.
High
CVE-2026-70007
Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows crafted pixel-shader bytecode to desynchronize parsing passes, leading to heap out-of-bounds memory corruption. Patched runtime and SDK versions have been released to resolve the issue.
High
CVE-2026-70186
Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability
A denial of service vulnerability in ASP.NET Core Kestrel allows unauthenticated remote attackers to trigger deadlocks in connection handling, causing thread exhaustion and server resource depletion.
High
CVE-2026-70035
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
A remote code execution vulnerability exists in .NET and Visual Studio due to improper untrusted data deserialization in Windows Desktop runtime packages. Applications using affected runtime versions should be updated to patched releases and recompiled if deployed as self-contained applications.
High
CVE-2026-85363
Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability
A vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows attacker-controlled XPS glyph coordinates to overflow pointer arithmetic, causing an out-of-bounds write and process termination.
High
CVE-2026-96222
Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
A spoofing vulnerability in System.Security.Cryptography.Xml allows serialized certificates with attacker-controlled chain metadata to be accepted, enabling certificate forgery and token spoofing. Mitigation requires updating .NET runtimes, SDKs, and affected package references.
High
CVE-2026-70179
Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability
An elevation of privilege vulnerability in Microsoft.AspNetCore.Authentication.Negotiate allows authenticated identities to be linked to unintended LDAP principals when SID verification fails. Affected systems should apply the latest .NET updates.
High
CVE-2026-96230
Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability
A vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server allows cross-origin script injection due to unencoded exception text in the Blazor development server debug page.
High
CVE-2026-96959
Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability
A denial of service vulnerability exists in .NET and Visual Studio packages System.Security.Cryptography.Xml and System.Private.Xml due to unbounded resource allocation. Remediate by updating packages and runtimes.
Medium
CVE-2026-85790
Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability
A Use After Free flaw in Microsoft.Native.Quic.MsQuic.Schannel on Windows exposes .NET applications to information disclosure. Developers should update to the latest .NET release or reference the patched package, then restart or recompile affected apps.
High
CVE-2026-96960
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability
A denial of service vulnerability in Microsoft .NET's System.Security.Cryptography.Xml and System.Private.Xml allows asymmetric resource consumption. Developers should update affected packages or runtimes to the patched versions and recompile self-contained apps.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.