Browse CVEs by Ecosystem and Severity

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

ImageMagick: Heap Buffer Over-Write in fx operation

ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

ImageMagick: Policy Bypass in concatenate operation due to missing checks

ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments

ImageMagick: Infinite Loop in connected-components when providing invalid arguments

ImageMagick: Stack Overflow in MVG decoder due to missing depth check.

ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

Steeltoe's static JWKS cache shared across schemes and never invalidated

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)

Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx

ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments

ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails

ImageMagick: Policy Bypass can read disallowed files via symlink

ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems

ImageMagick Vulnerable to Stack Overflow in its MVG Decoder

ImageMagick has an Infinite Loop in subimage-search with crafted image

ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

CoreWCF: SAML token replay protection is inoperative

CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

CoreWCF: WS-Security signature substitution via document-wide Signature lookup

NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

ImageMagick: Heap Buffer Over-Read in distributed pixel cache server