# NuGet Advisories.

Every NuGet Advisory we hold (.NET), newest first.

## Records, newest first (an older page)

- [ABP Account Module has an Open Redirect through Improper validation in its register function](https://agentprime.io/advisories/GHSA-vfm5-cr22-jg3m.md)
  `GHSA-vfm5-cr22-jg3m`, `CVE-2025-65581` · NuGet `Volo.Abp.Account.Web`: affected `>=5.1.0, <10.0.0-rc.2`, fixed in `10.0.0-rc.2` · CVSS 5.3 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Open redirect, CWE-20
- [ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only)](https://agentprime.io/advisories/GHSA-6hjr-v6g4-3fm8.md)
  `GHSA-6hjr-v6g4-3fm8`, `CVE-2025-66628` · NuGet `Magick.NET-Q16-AnyCPU` and 5 more: affected `<14.10.0`, fixed in `14.10.0` · CVSS 7.5 High · Not analysed yet · Published 10 Dec 2025 · Tags: Memory corruption
- [Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality](https://agentprime.io/advisories/GHSA-hfv2-pf68-m33x.md)
  `GHSA-hfv2-pf68-m33x`, `CVE-2025-66625` · NuGet `Umbraco.Cms`: affected `>=10.0.0, <13.12.1`, fixed in `13.12.1` · CVSS 4.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Information disclosure, CWE-377
- [Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)](https://agentprime.io/advisories/GHSA-wq34-7f4g-953v.md)
  `GHSA-wq34-7f4g-953v`, `CVE-2025-66631` · NuGet `Csla`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 7.2 High · Not analysed yet · Published 8 Dec 2025 · Tags: Insecure deserialization
- [Withdrawn Advisory: Emby Server API Vulnerability allowing to gain administrative access without precondition](https://agentprime.io/advisories/GHSA-95fv-5gfj-2r84.md)
  `GHSA-95fv-5gfj-2r84`, `CVE-2025-64113` · NuGet `MediaBrowser.Server.Core`: affected `<4.9.1.81`, fixed in `4.9.1.81` · CVSS 9.3 Critical · Withdrawn · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-640
- [Withdrawn Advisory: ImageMagick has a use-after-free/double-free risk in Options::fontFamily when clearing family](https://agentprime.io/advisories/GHSA-q3hc-j9x5-mp9m.md)
  `GHSA-q3hc-j9x5-mp9m`, `CVE-2025-65955` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<=14.9.1`, no fixed version yet · CVSS 4.9 Medium · Withdrawn · Not analysed yet · Published 3 Dec 2025 · Tags: Memory corruption
- [DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite](https://agentprime.io/advisories/GHSA-3m8r-w7xg-jqvw.md)
  `GHSA-3m8r-w7xg-jqvw`, `CVE-2025-64095` · NuGet `DNN.PLATFORM`: affected `<10.1.1`, fixed in `10.1.1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.47 · Not analysed yet · Published 29 Oct 2025 · Tags: Unrestricted file upload
- [DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload](https://agentprime.io/advisories/GHSA-hmvq-8p83-cq52.md)
  `GHSA-hmvq-8p83-cq52`, `CVE-2025-64094` · NuGet `DotNetNuke.Core`: affected `<10.1.1`, fixed in `10.1.1` · CVSS 6.4 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Cross-site scripting (XSS)
- [DNN CKEditor Provider allows unauthenticated upload out-of-the-box](https://agentprime.io/advisories/GHSA-2374-6cvw-qmx6.md)
  `GHSA-2374-6cvw-qmx6`, `CVE-2025-62802` · NuGet `Dnn.Platform`: affected `<10.1.1`, fixed in `10.1.1` · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Unrestricted file upload, CWE-1188
- [ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)](https://agentprime.io/advisories/GHSA-9pp9-cfwx-54rm.md)
  `GHSA-9pp9-cfwx-54rm`, `CVE-2025-62171` · NuGet `Magick.NET-Q16-AnyCPU` and 5 more: affected `<14.9.0`, fixed in `14.9.0` · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2025 · Tags: Memory corruption
- [ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)](https://agentprime.io/advisories/GHSA-wpp4-vqfq-v4hp.md)
  `GHSA-wpp4-vqfq-v4hp`, `CVE-2025-62594` · NuGet `Magick.NET-Q16-x64` and 11 more: affected `<=14.9.0`, no fixed version yet · CVSS 4.7 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Memory corruption, Denial of service
- [Piranha CMS vulnerable to stored cross-site scripting (XSS)](https://agentprime.io/advisories/GHSA-3qcp-9v8c-6jp7.md)
  `GHSA-3qcp-9v8c-6jp7`, `CVE-2025-61413` · NuGet `Piranha`: affected `<=12.0.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Cross-site scripting (XSS)
- [Mammoth is vulnerable to Directory Traversal](https://agentprime.io/advisories/GHSA-rmjr-87wv-gf87.md)
  `GHSA-rmjr-87wv-gf87`, `CVE-2025-11849`, `PYSEC-2026-1603` · npm `mammoth` and 3 more: affected `>=0.3.25, <1.11.0`, fixed in `1.11.0` · CVSS 6.4 Medium · Not analysed yet · Published 17 Oct 2025 · Tags: Path traversal
- [Smidge is vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-9rvm-p3qm-f4vv.md)
  `GHSA-9rvm-p3qm-f4vv`, `CVE-2025-11842` · NuGet `Smidge`: affected `<4.6.0`, fixed in `4.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Path traversal
- [Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-4mjw-xr5x-prpc.md)
  `GHSA-4mjw-xr5x-prpc`, `CVE-2025-54539` · NuGet `Apache.NMS.AMQP`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2025 · Tags: Insecure deserialization
- [Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-gwq6-fmvp-qp68.md)
  `GHSA-gwq6-fmvp-qp68`, `BIT-dotnet-2025-55248`, `BIT-dotnet-sdk-2025-55248`, `CVE-2025-55248` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.21 || >=9.0.0, <9.0.10`, fixed in `8.0.21`, `9.0.10` · CVSS 4.8 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: Weak cryptography or TLS
- [Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-w3q9-fxm7-j8fq.md)
  `GHSA-w3q9-fxm7-j8fq`, `BIT-dotnet-2025-55247`, `BIT-dotnet-sdk-2025-55247`, `CVE-2025-55247` · NuGet `Microsoft.Build.Tasks.Core` and 2 more: affected `>=17.8.0, <17.8.43 || >=17.10.0, <17.10.46 || >=17.11.0, <17.11.48 || >=17.12.0, <17.12.50 || >=17.14.0, <17.14.28 || >=17.15.0-preview-25277-114, <18.0.0-preview-25476-107`, fixed in `17.8.43`, `17.10.46`, `17.11.48`, `17.12.50`, `17.14.28`, `18.0.0-preview-25476-107` · CVSS 7.3 High · Not analysed yet · Published 15 Oct 2025 · Tags: Path traversal
- [Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-5rrx-jjjq-q2r5.md)
  `GHSA-5rrx-jjjq-q2r5`, `BIT-aspnet-core-2025-55315`, `CVE-2025-55315` · NuGet `Microsoft.AspNetCore.Server.Kestrel.Core` and 12 more: affected `<2.3.6`, fixed in `2.3.6` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.67 · Not analysed yet · Published 14 Oct 2025 · Tags: HTTP request smuggling
- [Duplicate Advisory: Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-q8g5-rw97-f55h.md)
  `GHSA-q8g5-rw97-f55h` · NuGet `Microsoft.Build.Tasks.Core`: affected `>=17.15.0-preview-25277-114, <18.0.0-preview-25476-107`, fixed in `18.0.0-preview-25476-107` · CVSS 7.3 High · Withdrawn · Not analysed yet · Published 14 Oct 2025 · Tags: Path traversal
- [Duplicate Advisory: Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-987x-96fq-9384.md)
  `GHSA-987x-96fq-9384` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm`: affected `>=9.0.0, <9.0.10`, fixed in `9.0.10` · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 14 Oct 2025 · Tags: Weak cryptography or TLS
- [Amazon.IonDotnet is vulnerable to Denial of Service attacks](https://agentprime.io/advisories/GHSA-q5r6-9qwq-g2wj.md)
  `GHSA-q5r6-9qwq-g2wj`, `CVE-2025-11573` · NuGet `Amazon.IonDotnet`: affected `<1.3.2`, fixed in `1.3.2` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2025 · Tags: Denial of service, CWE-1286
- [Akka.Remote TLS did not properly implement certificate-based authentication](https://agentprime.io/advisories/GHSA-jhpv-4q4f-43g5.md)
  `GHSA-jhpv-4q4f-43g5`, `CVE-2025-61778` · NuGet `Akka.Remote` and 1 more: affected `>=1.2.0, <1.5.52`, fixed in `1.5.52` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2025 · Tags: Authentication bypass, Weak cryptography or TLS
- [FormCMS has an improper access control vulnerability in the /api/schemas/history/\[schemaId\] endpoint](https://agentprime.io/advisories/GHSA-6cwx-42hw-w69c.md)
  `GHSA-6cwx-42hw-w69c`, `CVE-2025-55797` · NuGet `FormCMS`: affected `<0.5.5`, fixed in `0.5.5` · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: Information disclosure, Broken access control
- [PiranhaCMS stored XSS](https://agentprime.io/advisories/GHSA-456v-f425-8mcv.md)
  `GHSA-456v-f425-8mcv`, `CVE-2025-57692` · NuGet `Piranha`: affected `<=12.0`, no fixed version yet · CVSS 6.8 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Cross-site scripting (XSS)
- [DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile](https://agentprime.io/advisories/GHSA-jc4g-c8ww-5738.md)
  `GHSA-jc4g-c8ww-5738`, `CVE-2025-59821` · NuGet `DotNetNuke.Core`: affected `<10.1.0`, fixed in `10.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Cross-site scripting (XSS)
- [DNN Vulnerable to Stored XSS Using Backend Admin Credentials](https://agentprime.io/advisories/GHSA-gj8m-5492-q98h.md)
  `GHSA-gj8m-5492-q98h`, `CVE-2025-59546` · NuGet `DotNetNuke.Core`: affected `<10.1.0`, fixed in `10.1.0` · CVSS 2.4 Low · Not analysed yet · Published 23 Sept 2025 · Tags: Cross-site scripting (XSS)
- [DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module](https://agentprime.io/advisories/GHSA-2qxc-mf4x-wr29.md)
  `GHSA-2qxc-mf4x-wr29`, `CVE-2025-59545` · NuGet `DotNetNuke.Core`: affected `<10.1.0`, fixed in `10.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2025 · Tags: Cross-site scripting (XSS)
- [DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field](https://agentprime.io/advisories/GHSA-7rcc-q6rq-jpcm.md)
  `GHSA-7rcc-q6rq-jpcm`, `CVE-2025-59539` · NuGet `DotNetNuke.Core`: affected `<10.1.0`, fixed in `10.1.0` · CVSS 6.3 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Cross-site scripting (XSS)
- [DNN allows loading unused themes on anonymous clients through query parameters](https://agentprime.io/advisories/GHSA-wq2j-w9pm-7x2p.md)
  `GHSA-wq2j-w9pm-7x2p`, `CVE-2025-59535` · NuGet `DotNetNuke.Core`: affected `<10.1.0`, fixed in `10.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Information disclosure, CWE-20, CWE-829
- [Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain](https://agentprime.io/advisories/GHSA-w7r3-mgwf-4mqq.md)
  `GHSA-w7r3-mgwf-4mqq`, `CVE-2025-9708` · NuGet `KubernetesClient`: affected `<17.0.14`, fixed in `17.0.14` · CVSS 6.8 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: Weak cryptography or TLS
- [ImageMagick BlobStream Forward-Seek Under-Allocation](https://agentprime.io/advisories/GHSA-23hg-53q6-hqfg.md)
  `GHSA-23hg-53q6-hqfg`, `CVE-2025-57807` · NuGet `Magick.NET-Q16-x64` and 11 more: affected `<14.8.2`, fixed in `14.8.2` · CVSS 3.8 Low · Not analysed yet · Published 5 Sept 2025 · Tags: Memory corruption
- [FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-4fxf-xgrm-8fcj.md)
  `GHSA-4fxf-xgrm-8fcj`, `CVE-2025-56236` · NuGet `FormCMS`: affected `<0.5.7`, fixed in `0.5.7` · CVSS 6.1 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow](https://agentprime.io/advisories/GHSA-mxvv-97wh-cfmm.md)
  `GHSA-mxvv-97wh-cfmm`, `CVE-2025-57803` · NuGet `Magick.NET-Q16-AnyCPU` and 5 more: affected `<14.8.1`, fixed in `14.8.1` · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2025 · Tags: Memory corruption
- [ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution](https://agentprime.io/advisories/GHSA-9ccg-6pjw-x645.md)
  `GHSA-9ccg-6pjw-x645`, `CVE-2025-55298` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.8.1`, fixed in `14.8.1` · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2025 · Tags: Memory corruption, CWE-123
- [ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash](https://agentprime.io/advisories/GHSA-fh55-q5pj-pxgw.md)
  `GHSA-fh55-q5pj-pxgw`, `CVE-2025-55212` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.8.1`, fixed in `14.8.1` · CVSS 3.7 Low · Not analysed yet · Published 26 Aug 2025 · Tags: Denial of service
- [ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree](https://agentprime.io/advisories/GHSA-6hgw-6x87-578x.md)
  `GHSA-6hgw-6x87-578x`, `CVE-2025-55160` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.8.0`, fixed in `14.8.0` · CVSS 6.1 Medium · Not analysed yet · Published 25 Aug 2025 · Tags: CWE-758
- [imagemagick: integer overflows in MNG magnification](https://agentprime.io/advisories/GHSA-qp29-wxp5-wh82.md)
  `GHSA-qp29-wxp5-wh82`, `CVE-2025-55154` · NuGet `Magick.NET-Q8-x86` and 17 more: affected `<14.8.0`, fixed in `14.8.0` · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2025 · Tags: Memory corruption
- [imagemagick: heap-buffer overflow read in MNG magnification with alpha](https://agentprime.io/advisories/GHSA-cjc8-g9w8-chfw.md)
  `GHSA-cjc8-g9w8-chfw`, `CVE-2025-55004` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.8.0`, fixed in `14.8.0` · CVSS 7.6 High · Not analysed yet · Published 25 Aug 2025 · Tags: Memory corruption
- [ImageMagick has a heap-buffer-overflow](https://agentprime.io/advisories/GHSA-fff3-4rp7-px97.md)
  `GHSA-fff3-4rp7-px97`, `CVE-2025-68469` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<13.2.0`, fixed in `13.2.0` · CVSS 2.0 Low · Not analysed yet · Published 25 Aug 2025 · Tags: Memory corruption
- [ImageMagick has a Memory Leak in magick stream](https://agentprime.io/advisories/GHSA-cfh4-9f7v-fhrc.md)
  `GHSA-cfh4-9f7v-fhrc`, `CVE-2025-53019` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.7.0`, fixed in `14.7.0` · CVSS 3.7 Low · Not analysed yet · Published 25 Aug 2025 · Tags: Memory corruption, Denial of service
- [ImageMagick has a Heap Buffer Overflow in InterpretImageFilename](https://agentprime.io/advisories/GHSA-hm4x-r5hc-794f.md)
  `GHSA-hm4x-r5hc-794f`, `CVE-2025-53014` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.7.0`, fixed in `14.7.0` · CVSS 3.7 Low · Not analysed yet · Published 25 Aug 2025 · Tags: Memory corruption, CWE-193
- [ImageMagick has a Stack Buffer Overflow in image.c](https://agentprime.io/advisories/GHSA-qh3h-j545-h8c9.md)
  `GHSA-qh3h-j545-h8c9`, `CVE-2025-53101` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.7.0`, fixed in `14.7.0` · CVSS 7.4 High · Not analysed yet · Published 25 Aug 2025 · Tags: Memory corruption
- [SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks](https://agentprime.io/advisories/GHSA-rxmq-m78w-7wmc.md)
  `GHSA-rxmq-m78w-7wmc`, `CVE-2025-54575` · NuGet `SixLabors.ImageSharp`: affected `<2.1.11 || >=3.0.0, <3.1.11`, fixed in `2.1.11`, `3.1.11` · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Denial of service
- [Umbraco Delivery API allows for cached requests to be returned with an invalid API key](https://agentprime.io/advisories/GHSA-75vq-qvhr-7ffr.md)
  `GHSA-75vq-qvhr-7ffr`, `CVE-2025-54425` · NuGet `Umbraco.Cms.Api.Delivery`: affected `>=13.0.0, <13.9.3 || >=15.0.0, <15.4.4 || >=16.0.0, <16.1.1`, fixed in `13.9.3`, `15.4.4`, `16.1.1` · CVSS 5.3 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: Information disclosure
- [ImageMagick has XMP profile write that triggers hang due to unbounded loop](https://agentprime.io/advisories/GHSA-vmhh-8rxq-fp9g.md)
  `GHSA-vmhh-8rxq-fp9g`, `CVE-2025-53015` · NuGet `Magick.NET-Q8-AnyCPU` and 18 more: affected `<14.7.0`, fixed in `14.7.0` · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2025 · Tags: Denial of service
- [SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite](https://agentprime.io/advisories/GHSA-2m69-gcr7-jv3q.md)
  `GHSA-2m69-gcr7-jv3q`, `BIT-sqlite-2025-6965`, `CVE-2025-6965` · NuGet `SQLitePCLRaw.lib.e_sqlite3` and 2 more: affected `<=2.1.11`, no fixed version yet · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.73 · Not analysed yet · Published 15 Jul 2025 · Tags: CWE-197
- [Umbraco CMS disclosure of configured password requirements](https://agentprime.io/advisories/GHSA-pgvc-6h2p-q4f6.md)
  `GHSA-pgvc-6h2p-q4f6`, `CVE-2025-49147` · NuGet `Umbraco.Cms`: affected `>=10.0.0, <10.8.11 || >=13.0.0, <13.9.2`, fixed in `10.8.11`, `13.9.2` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: Information disclosure
- [DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input](https://agentprime.io/advisories/GHSA-mgfv-2362-jq96.md)
  `GHSA-mgfv-2362-jq96`, `CVE-2025-52488` · NuGet `DNN.PLATFORM`: affected `>=6.0.0, <10.0.1`, fixed in `10.0.1` · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.36 · Not analysed yet · Published 20 Jun 2025 · Tags: Information disclosure
- [DNN.PLATFORM possibly allows bypass of IP Filters](https://agentprime.io/advisories/GHSA-fjhg-3mrh-mm7h.md)
  `GHSA-fjhg-3mrh-mm7h`, `CVE-2025-52487` · NuGet `DNN.PLATFORM`: affected `>=7.0.0, <10.0.1`, fixed in `10.0.1` · CVSS 8.8 High · Not analysed yet · Published 20 Jun 2025 · Tags: Broken access control
- [DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed](https://agentprime.io/advisories/GHSA-wwc9-wmm3-2pmf.md)
  `GHSA-wwc9-wmm3-2pmf`, `CVE-2025-52485` · NuGet `DNN.PLATFORM`: affected `>=6.0.0, <10.0.1`, fixed in `10.0.1` · CVSS 5.1 Medium · Not analysed yet · Published 20 Jun 2025 · Tags: Cross-site scripting (XSS)
- [DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects](https://agentprime.io/advisories/GHSA-pf4h-vrv6-cmvr.md)
  `GHSA-pf4h-vrv6-cmvr`, `CVE-2025-52486` · NuGet `DNN.PLATFORM`: affected `>=6.0.0, <10.0.1`, fixed in `10.0.1` · CVSS 6.1 Medium · Not analysed yet · Published 20 Jun 2025 · Tags: Cross-site scripting (XSS)
- [DotVVM allows path traversal when deployed in Debug mode](https://agentprime.io/advisories/GHSA-6q65-j4jw-9cg8.md)
  `GHSA-6q65-j4jw-9cg8` · NuGet `DotVVM`: affected `<4.2.10 || >=4.3.0-preview01-final, <4.3.8 || >=5.0.0-preview01-final, <5.0.0-preview03-final`, fixed in `4.2.10`, `4.3.8`, `5.0.0-preview03-final` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2025 · Tags: Path traversal
- [Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates](https://agentprime.io/advisories/GHSA-px2c-r924-mwcc.md)
  `GHSA-px2c-r924-mwcc`, `CVE-2025-49015` · NuGet `CouchbaseNetClient`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 4.9 Medium · Not analysed yet · Published 18 Jun 2025 · Tags: Weak cryptography or TLS
- [Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability](https://agentprime.io/advisories/GHSA-266m-wp2v-x7mq.md)
  `GHSA-266m-wp2v-x7mq`, `BIT-dotnet-2025-30399`, `BIT-dotnet-sdk-2025-30399`, `BIT-powershell-2025-30399`, `CVE-2025-30399` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.17 || >=9.0.0, <9.0.6`, fixed in `8.0.17`, `9.0.6` · CVSS 7.5 High · Not analysed yet · Published 11 Jun 2025 · Tags: CWE-426
- [Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads](https://agentprime.io/advisories/GHSA-fr6r-p8hv-x3c4.md)
  `GHSA-fr6r-p8hv-x3c4`, `CVE-2025-48953` · NuGet `Umbraco.Cms`: affected `>=14.0.0, <15.4.2`, fixed in `15.4.2` · CVSS 5.5 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: Unrestricted file upload
- [DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline](https://agentprime.io/advisories/GHSA-m4hf-fxcg-cp34.md)
  `GHSA-m4hf-fxcg-cp34`, `CVE-2025-48378` · NuGet `DotNetNuke.Core`: affected `<9.13.9`, fixed in `9.13.9` · CVSS 6.1 Medium · Not analysed yet · Published 23 May 2025 · Tags: Cross-site scripting (XSS)
- [Reflected Cross-Site Scripting (XSS) in module actions in edit mode](https://agentprime.io/advisories/GHSA-79m3-rvx2-3qq9.md)
  `GHSA-79m3-rvx2-3qq9`, `CVE-2025-48377` · NuGet `DotNetNuke.Web` and 1 more: affected `<9.13.9`, fixed in `9.13.9` · CVSS 6.0 Medium · Not analysed yet · Published 23 May 2025 · Tags: Cross-site scripting (XSS)
- [DNN site Import could use an external source with a crafted request](https://agentprime.io/advisories/GHSA-62mf-vhhw-xmf8.md)
  `GHSA-62mf-vhhw-xmf8`, `CVE-2025-48376` · NuGet `DotNetNuke.SiteExportImport`: affected `<9.13.9`, fixed in `9.13.9` · CVSS 3.5 Low · Not analysed yet · Published 23 May 2025 · Tags: CWE-841
- [Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability](https://agentprime.io/advisories/GHSA-h4j7-5rxr-p4wc.md)
  `GHSA-h4j7-5rxr-p4wc`, `BIT-dotnet-2025-26646`, `BIT-dotnet-sdk-2025-26646`, `CVE-2025-26646` · NuGet `Microsoft.Build.Tasks.Core`: affected `>=15.8.166, <15.9.30 || >=16.0.461, <16.11.6 || >=17.0.0, <17.8.29 || >=17.9.5, <17.10.29 || >=17.11.4, <17.12.36 || >=17.12.6, <17.13.26 || >=17.13.9, <17.14.8`, fixed in `15.9.30`, `16.11.6`, `17.8.29`, `17.10.29`, `17.12.36`, `17.13.26`, `17.14.8` · CVSS 8.0 High · Not analysed yet · Published 13 May 2025 · Tags: Path traversal
- [Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow](https://agentprime.io/advisories/GHSA-2qrj-g9hq-chph.md)
  `GHSA-2qrj-g9hq-chph`, `CVE-2025-47280` · NuGet `Umbraco.Forms` and 1 more: affected `>=7.0.0, <13.4.2 || >=14.0.0, <15.1.2`, fixed in `13.4.2`, `15.1.2` · CVSS 2.3 Low · Not analysed yet · Published 13 May 2025 · Tags: CWE-116

Newest: <https://agentprime.io/advisories/ecosystem/nuget.md>
Older: <https://agentprime.io/advisories/ecosystem/nuget.md?cursor=WyIyMDI1LTA1LTEzVDIwOjE3OjM2LjAwMDAwMFoiLCJHSFNBLTJxcmotZzlocS1jaHBoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=NuGet&cursor=WyIyMDI1LTEyLTE4VDE1OjQ2OjE2LjAwMDAwMFoiLCJHSFNBLTR2NDItNjVyMy0zZ2p4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/nuget/?cursor=WyIyMDI1LTEyLTE4VDE1OjQ2OjE2LjAwMDAwMFoiLCJHSFNBLTR2NDItNjVyMy0zZ2p4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.