Browse CVEs by Ecosystem and Severity

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Prompty: Arbitrary file read via file reference expansion

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString

ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

Snappier has an infinite loop during SnappyStream decompression with malformed framed input

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder

ImageMagick has a Stack Overflow in DestroyXMLTree()

DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload

Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory

AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction

Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException

Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service

Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()

Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix