# NuGet Advisories.

Every NuGet Advisory we hold (.NET), newest first.

## Records, newest first (an older page)

- [ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds](https://agentprime.io/advisories/GHSA-v67w-737x-v2c9.md)
  `GHSA-v67w-737x-v2c9`, `CVE-2026-33900` · NuGet `Magick.NET-Q16-AnyCPU` and 5 more: affected `<14.12.0`, fixed in `14.12.0` · CVSS 5.9 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: Memory corruption
- [DNN: Same HostGUID for all new installs](https://agentprime.io/advisories/GHSA-2rhw-gw3f-477j.md)
  `GHSA-2rhw-gw3f-477j`, `CVE-2026-40306` · NuGet `DotNetNuke.Core`: affected `>=10.0.0, <10.2.2`, fixed in `10.2.2` · CVSS 6.9 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Weak cryptography or TLS
- [DNN: Force Friend Request Acceptance](https://agentprime.io/advisories/GHSA-fpj4-9qhx-5m6m.md)
  `GHSA-fpj4-9qhx-5m6m`, `CVE-2026-40305` · NuGet `DotNetNuke.Core`: affected `>=6.0.0, <10.2.2`, fixed in `10.2.2` · CVSS 4.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload](https://agentprime.io/advisories/GHSA-ffq7-898w-9jc4.md)
  `GHSA-ffq7-898w-9jc4`, `CVE-2026-40321` · NuGet `DotNetNuke.Core`: affected `<10.2.2`, fixed in `10.2.2` · CVSS 8.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: Cross-site scripting (XSS)
- [Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters](https://agentprime.io/advisories/GHSA-4f7c-pmjv-c25w.md)
  `GHSA-4f7c-pmjv-c25w`, `CVE-2026-40021` · NuGet `log4net`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 6.3 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-116
- [Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service](https://agentprime.io/advisories/GHSA-xrw6-gwf8-vvr9.md)
  `GHSA-xrw6-gwf8-vvr9`, `CVE-2026-39959` · NuGet `Tmds.DBus` and 1 more: affected `<0.92.0`, fixed in `0.92.0` · CVSS 7.1 High · Not analysed yet · Published 8 Apr 2026 · Tags: Authentication bypass, Denial of service
- [EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory](https://agentprime.io/advisories/GHSA-32wq-ppwg-3w4m.md)
  `GHSA-32wq-ppwg-3w4m` · NuGet `EnhancedLinq.Async`: affected `>=1.0.0-beta.1, <1.0.0-beta.3`, fixed in `1.0.0-beta.3` · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-129, CWE-1395
- [AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction](https://agentprime.io/advisories/GHSA-mvm6-f9r3-fgfx.md)
  `GHSA-mvm6-f9r3-fgfx` · NuGet `AWSSDK.CloudFront` and 1 more: affected `<3.7.510.7`, fixed in `3.7.510.7` · CVSS 4.0, no score published · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-20, CWE-116
- [ImageMagick: META reader memory leak in the APP1JPEG input path](https://agentprime.io/advisories/GHSA-9r56-3gjq-hqf7.md)
  `GHSA-9r56-3gjq-hqf7`, `CVE-2026-56366` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.11.1`, fixed in `14.11.1` · CVSS 4.8 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Denial of service
- [ImageMagick has possible memory leak in ASHLAR coder when action fails](https://agentprime.io/advisories/GHSA-6p22-q7w5-33pg.md)
  `GHSA-6p22-q7w5-33pg`, `CVE-2026-56375` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.11.1`, fixed in `14.11.1` · CVSS 4.8 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Denial of service
- [ImageMagick has an Out-of-bounds Write via InterpretImageFilename](https://agentprime.io/advisories/GHSA-8793-7xv6-82cf.md)
  `GHSA-8793-7xv6-82cf`, `CVE-2026-33536` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.11.1`, fixed in `14.11.1` · CVSS 5.1 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Memory corruption
- [ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction](https://agentprime.io/advisories/GHSA-mw3m-pqr2-qv7c.md)
  `GHSA-mw3m-pqr2-qv7c`, `CVE-2026-33535` · NuGet `Magick.NET-Q16-AnyCPU` and 17 more: affected `<14.11.1`, fixed in `14.11.1` · CVSS 4.0 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Memory corruption
- [Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation](https://agentprime.io/advisories/GHSA-xw6w-9jjh-p9cr.md)
  `GHSA-xw6w-9jjh-p9cr`, `CVE-2026-74785` · NuGet `Scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 7.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString](https://agentprime.io/advisories/GHSA-m2p3-hwv5-xpqw.md)
  `GHSA-m2p3-hwv5-xpqw`, `CVE-2026-74786` · NuGet `Scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 7.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Scriban has Uncontrolled Recursion in \`object.to_json\` Causing Unrecoverable Process Crash via StackOverflowException](https://agentprime.io/advisories/GHSA-xcx6-vp38-8hr5.md)
  `GHSA-xcx6-vp38-8hr5`, `CVE-2026-74787` · NuGet `Scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 8.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service](https://agentprime.io/advisories/GHSA-v66j-x4hw-fv9g.md)
  `GHSA-v66j-x4hw-fv9g`, `CVE-2026-74788` · NuGet `Scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 8.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service](https://agentprime.io/advisories/GHSA-c875-h985-hvrc.md)
  `GHSA-c875-h985-hvrc`, `CVE-2026-74789` · NuGet `scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 8.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse](https://agentprime.io/advisories/GHSA-5wr9-m6jw-xx44.md)
  `GHSA-5wr9-m6jw-xx44`, `CVE-2026-74790` · NuGet `scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-693
- [Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()](https://agentprime.io/advisories/GHSA-x6m9-38vm-2xhf.md)
  `GHSA-x6m9-38vm-2xhf`, `CVE-2026-74791` · NuGet `scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-226
- [Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix](https://agentprime.io/advisories/GHSA-p6q4-fgr8-vx4p.md)
  `GHSA-p6q4-fgr8-vx4p`, `CVE-2026-74792` · NuGet `Scriban` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 8.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Duplicate Advisory: OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access](https://agentprime.io/advisories/GHSA-vmvw-pwwf-cc2w.md)
  `GHSA-vmvw-pwwf-cc2w` · NuGet `openclaw`: affected `<=2026.2.25`, no fixed version yet · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 21 Mar 2026 · Tags: Broken access control
- [Scriban Affected by Memory Exhaustion (OOM) via Unbounded String Generation (Denial of Service)](https://agentprime.io/advisories/GHSA-5rpf-x9jg-8j5p.md)
  `GHSA-5rpf-x9jg-8j5p` · NuGet `scriban` and 1 more: affected `<6.6.0`, fixed in `6.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Denial of service
- [Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)](https://agentprime.io/advisories/GHSA-grr9-747v-xvcp.md)
  `GHSA-grr9-747v-xvcp`, `CVE-2026-74794` · NuGet `scriban` and 1 more: affected `<6.6.0`, fixed in `6.6.0` · CVSS 8.7 High · Not analysed yet · Published 19 Mar 2026 · Tags: Denial of service
- [Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)](https://agentprime.io/advisories/GHSA-wgh7-7m3c-fx25.md)
  `GHSA-wgh7-7m3c-fx25`, `CVE-2026-74795` · NuGet `scriban` and 1 more: affected `<6.6.0`, fixed in `6.6.0` · CVSS 8.7 High · Not analysed yet · Published 19 Mar 2026 · Tags: Denial of service
- [ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash](https://agentprime.io/advisories/GHSA-gc62-2v5p-qpmp.md)
  `GHSA-gc62-2v5p-qpmp`, `CVE-2026-32636` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.11.0`, fixed in `14.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Memory corruption
- [AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion](https://agentprime.io/advisories/GHSA-rvv3-g6hj-g44x.md)
  `GHSA-rvv3-g6hj-g44x`, `CVE-2026-32933` · NuGet `AutoMapper`: affected `<15.1.1 || >=16.0.0, <16.1.1`, fixed in `15.1.1`, `16.1.1` · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: Denial of service
- [idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-8fh9-c4jq-94h4.md)
  `GHSA-8fh9-c4jq-94h4` · NuGet `idunno.AtProto` and 2 more: affected `<1.7.0`, fixed in `1.7.0` · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-129
- [ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS](https://agentprime.io/advisories/GHSA-j96m-mjp6-99xr.md)
  `GHSA-j96m-mjp6-99xr`, `CVE-2023-1289` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<13.0.0`, fixed in `13.0.0` · CVSS 5.5 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Denial of service, CWE-20
- [ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation](https://agentprime.io/advisories/GHSA-qpg4-j99f-8xcg.md)
  `GHSA-qpg4-j99f-8xcg`, `CVE-2026-30937` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 6.8 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage](https://agentprime.io/advisories/GHSA-5ggv-92r5-cp4p.md)
  `GHSA-5ggv-92r5-cp4p`, `CVE-2026-30936` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 5.5 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has Heap Buffer Over-Read in BilateralBlurImage](https://agentprime.io/advisories/GHSA-cqw9-w2m7-r2m2.md)
  `GHSA-cqw9-w2m7-r2m2`, `CVE-2026-30935` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 4.4 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has heap-based buffer overflow in UHDR encoder](https://agentprime.io/advisories/GHSA-h95r-c8c7-mrwx.md)
  `GHSA-h95r-c8c7-mrwx`, `CVE-2026-30931` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 6.8 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has stack buffer overflow in MagnifyImage](https://agentprime.io/advisories/GHSA-rqq8-jh93-f4vg.md)
  `GHSA-rqq8-jh93-f4vg`, `CVE-2026-30929` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 7.7 High · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write](https://agentprime.io/advisories/GHSA-hffp-q43q-qq76.md)
  `GHSA-hffp-q43q-qq76`, `CVE-2026-28693` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 8.1 High · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has uninitialized pointer dereference in JBIG decoder](https://agentprime.io/advisories/GHSA-wj8w-pjxf-9g4f.md)
  `GHSA-wj8w-pjxf-9g4f`, `CVE-2026-28691` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 7.5 High · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption, CWE-252
- [ImageMagick has stack write buffer overflow in MNG encoder](https://agentprime.io/advisories/GHSA-7h7q-j33q-hvpf.md)
  `GHSA-7h7q-j33q-hvpf`, `CVE-2026-28690` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 6.9 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has heap use-after-free in the MSL encoder](https://agentprime.io/advisories/GHSA-xxw5-m53x-j38c.md)
  `GHSA-xxw5-m53x-j38c`, `CVE-2026-28688` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 4.0 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder](https://agentprime.io/advisories/GHSA-fpvf-frm6-625q.md)
  `GHSA-fpvf-frm6-625q`, `CVE-2026-28687` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer](https://agentprime.io/advisories/GHSA-467j-76j7-5885.md)
  `GHSA-467j-76j7-5885`, `CVE-2026-28686` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 6.8 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays](https://agentprime.io/advisories/GHSA-932h-jw47-73jm.md)
  `GHSA-932h-jw47-73jm`, `CVE-2026-28494` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 7.1 High · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder](https://agentprime.io/advisories/GHSA-r39q-jr8h-gcq2.md)
  `GHSA-r39q-jr8h-gcq2`, `CVE-2026-28493` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 6.5 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.](https://agentprime.io/advisories/GHSA-wrhr-rf8j-r842.md)
  `GHSA-wrhr-rf8j-r842`, `CVE-2026-26284` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.5 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has heap buffer overflow in YUV 4:2:2 decoder](https://agentprime.io/advisories/GHSA-mqfc-82jx-3mr2.md)
  `GHSA-mqfc-82jx-3mr2`, `CVE-2026-25986` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)](https://agentprime.io/advisories/GHSA-pmq6-8289-hx3v.md)
  `GHSA-pmq6-8289-hx3v`, `CVE-2026-25982` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.5 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick: MSL - Stack overflow in ProcessMSLScript](https://agentprime.io/advisories/GHSA-8mpr-6xr2-chhc.md)
  `GHSA-8mpr-6xr2-chhc`, `CVE-2026-25971` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 6.2 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Denial of service, Memory corruption
- [ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption](https://agentprime.io/advisories/GHSA-xg29-8ghv-v4xr.md)
  `GHSA-xg29-8ghv-v4xr`, `CVE-2026-25970` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.](https://agentprime.io/advisories/GHSA-3mwp-xqp2-q6ph.md)
  `GHSA-3mwp-xqp2-q6ph`, `CVE-2026-25968` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 7.4 High · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [.NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-73j8-2gch-69rq.md)
  `GHSA-73j8-2gch-69rq`, `BIT-dotnet-2026-26127`, `BIT-dotnet-sdk-2026-26127`, `CVE-2026-26127` · NuGet `Microsoft.Bcl.Memory` and 12 more: affected `>=9.0.0, <9.0.14 || >=10.0.0, <10.0.4`, fixed in `9.0.14`, `10.0.4` · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: Memory corruption
- [.NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-4vgm-c2wm-63mw.md)
  `GHSA-4vgm-c2wm-63mw`, `BIT-aspnet-core-2026-26130`, `CVE-2026-26130` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.25 || >=9.0.0, <9.0.14 || >=10.0.0, <10.0.4`, fixed in `8.0.25`, `9.0.14`, `10.0.4` · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: Denial of service
- [.NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-crjq-wm6x-6qx7.md)
  `GHSA-crjq-wm6x-6qx7`, `BIT-dotnet-2026-26131`, `BIT-dotnet-sdk-2026-26131`, `CVE-2026-26131` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 5 more: affected `>=10.0.0, <10.0.4`, fixed in `10.0.4` · CVSS 7.8 High · Not analysed yet · Published 11 Mar 2026 · Tags: Broken access control
- [Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks](https://agentprime.io/advisories/GHSA-rhcg-3h8r-v6vp.md)
  `GHSA-rhcg-3h8r-v6vp`, `CVE-2026-31834` · NuGet `Umbraco.Cms`: affected `>=15.3.1, <16.5.1 || >=17.0.0, <17.2.2`, fixed in `16.5.1`, `17.2.2` · CVSS 7.2 High · Not analysed yet · Published 11 Mar 2026 · Tags: Privilege escalation, Broken access control
- [Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering](https://agentprime.io/advisories/GHSA-vrqc-59mw-qqg7.md)
  `GHSA-vrqc-59mw-qqg7`, `CVE-2026-31833` · NuGet `Umbraco.Cms`: affected `>=16.2.0, <16.5.1 || >=17.0.0, <17.2.2`, fixed in `16.5.1`, `17.2.2` · CVSS 6.7 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Cross-site scripting (XSS)
- [Umbraco Backoffice API Allows Unauthorized Modification of Domain Data](https://agentprime.io/advisories/GHSA-fpvf-fvp5-996r.md)
  `GHSA-fpvf-fvp5-996r`, `CVE-2026-31832` · NuGet `Umbraco.Cms`: affected `>=14.0.0, <16.5.1 || >=17.0.0, <17.2.2`, fixed in `16.5.1`, `17.2.2` · CVSS 5.4 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Broken access control
- [ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder](https://agentprime.io/advisories/GHSA-56jp-jfqg-f8f4.md)
  `GHSA-56jp-jfqg-f8f4`, `CVE-2026-31853` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 5.7 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Memory corruption
- [ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder](https://agentprime.io/advisories/GHSA-qmw5-2p58-xvrc.md)
  `GHSA-qmw5-2p58-xvrc`, `CVE-2026-30883` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 5.7 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Memory corruption
- [ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder](https://agentprime.io/advisories/GHSA-mrmj-x24c-wwcv.md)
  `GHSA-mrmj-x24c-wwcv`, `CVE-2026-28692` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 4.8 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Memory corruption
- [ImageMagick has a Path Policy TOCTOU symlink race bypass](https://agentprime.io/advisories/GHSA-493f-jh8w-qhx3.md)
  `GHSA-493f-jh8w-qhx3`, `CVE-2026-28689` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.4`, fixed in `14.10.4` · CVSS 6.3 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Path traversal, Race condition
- [Duplicate Advisory: .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-vh8f-65qg-3m8j.md)
  `GHSA-vh8f-65qg-3m8j` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm`: affected `>=8.0.0, <8.0.25`, fixed in `8.0.25` · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 10 Mar 2026 · Tags: Denial of service
- [Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network](https://agentprime.io/advisories/GHSA-hhfx-wfvq-7g9c.md)
  `GHSA-hhfx-wfvq-7g9c`, `CVE-2026-26118`, `PYSEC-2026-2669` · NuGet `Azure.Mcp` and 2 more: affected `>=1.0.0, <1.0.2 || >=2.0.0-beta.1, <2.0.0-beta.17`, fixed in `1.0.2`, `2.0.0-beta.17` · CVSS 8.8 High · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Duplicate Advisory: .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-c8gq-rhqh-wgwm.md)
  `GHSA-c8gq-rhqh-wgwm` · NuGet `Microsoft.Bcl.Memory`: affected `>=9.0.0, <=9.0.13`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 10 Mar 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/ecosystem/nuget.md>
Older: <https://agentprime.io/advisories/ecosystem/nuget.md?cursor=WyIyMDI2LTAzLTEwVDE4OjMxOjIxLjAwMDAwMFoiLCJHSFNBLWM4Z3EtcmhxaC13Z3dtIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=NuGet&cursor=WyIyMDI2LTA0LTEzVDE5OjEwOjAzLjAwMDAwMFoiLCJHSFNBLTI2cXAtZmZqaC0yeDR2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/nuget/?cursor=WyIyMDI2LTA0LTEzVDE5OjEwOjAzLjAwMDAwMFoiLCJHSFNBLTI2cXAtZmZqaC0yeDR2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.