NuGet Advisories.

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

• CWE-204

<10.8.10 || >=11.0.0-rc1, <13.8.1 · fixed in 10.8.10, 13.8.1

Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file

• Race condition

>=2.1.2, <4.4.1 · fixed in 4.4.1

YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

• Command injection

>=1.0.0-beta4, <1.1.2 · fixed in 1.1.2

Infinite loop condition in Amazon.IonDotnet

• Insecure deserialization
• Denial of service

<1.3.1 · fixed in 1.3.1

Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability

• Insecure deserialization

<2.1.1 · fixed in 2.1.1

CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows

<134.3.90 · fixed in 134.3.90

Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

• Information disclosure

>=7.1.0, <9.0.0 · fixed in 9.0.0

DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

• Server-side request forgery (SSRF)

<9.13.8 · fixed in 9.13.8

Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

• Path traversal

>=14.0.0--preview004, <14.3.4 || >=15.0.0-rc1, <15.3.1 · fixed in 14.3.4, 15.3.1

Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability

• Authentication bypass

>=6.0.0, <=6.0.36 || >=8.0.0, <8.0.14 || >=9.0.0, <9.0.3 · fixed in 8.0.14, 9.0.3

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

• Broken access control

<10.8.9 || >=11.0.0-rc1, <13.7.1 · fixed in 10.8.9, 13.7.1

Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality

• Broken access control

<14.3.3 || >=15.0.0-rc1, <15.2.3 · fixed in 14.3.3, 15.2.3

Microsoft Security Advisory CVE-2025-24043 | WinDbg Remote Code Execution Vulnerability

• Weak cryptography or TLS

<9.0.607601 · fixed in 9.0.607601

DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api

• Denial of service

>=1.10.0-beta.1, <1.11.0 · fixed in 1.11.0

Out-of-bounds Write in SixLabors ImageSharp

• Memory corruption

<2.1.10 || >=3.0.0, <3.1.7 · fixed in 2.1.10, 3.1.7

OpenTelemetry .NET has Denial of Service (DoS) Vulnerability in API Package

• Denial of service

>=1.11.0, <1.11.2 · fixed in 1.11.2

Security Update for the OPC UA .NET Standard Stack

• Broken access control
• CWE-208

<1.5.374.158 · fixed in 1.5.374.158

Security Update for the OPC UA .NET Standard Stack

• Authentication bypass
• CWE-305

<1.5.374.158 · fixed in 1.5.374.158

AutoQueryable leaks sensitive information

• Information disclosure

<=2.0.11-beta · no fixed version yet

Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

• Race condition

<3.2.0 · fixed in 3.2.0

AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass

• Authentication bypass

<2.1.0 · fixed in 2.1.0

The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass

• Authentication bypass

<3.4.0 · fixed in 3.4.0

Duplicate Advisory: Authorization Bypass in OPC UA .NET Standard Stack

• Broken access control
• CWE-208

<1.5.374.158 · fixed in 1.5.374.158

Duplicate Advisory: Authentication Bypass by Spoofing in OPC UA .NET Standard Stack

• Authentication bypass
• CWE-305

<1.5.374.158 · fixed in 1.5.374.158

TShock allows chat while not fully connected, possible ban evasion

• Broken access control

<5.2.2 · fixed in 5.2.2

Snowflake.Data has weak temporary files permissions

• Broken access control

>=2.0.12, <4.3.0 · fixed in 4.3.0

Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting

• Cross-site scripting (XSS)

<15.0.0 · fixed in 15.0.0

Property reflection in System.Linq.Dynamic.Core

• Broken access control

<1.6.0 · fixed in 1.6.0

XSS/HTML Injection Vulnerability in Umbraco Preview Badge

• Cross-site scripting (XSS)
• Code injection

>=10.8.7, <10.8.8 || >=11.0.0, <13.5.3 || >=14.0.0, <14.3.2 || >=15.0.0, <15.1.2 · fixed in 10.8.8, 13.5.3, 14.3.2, 15.1.2

Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes

• Information disclosure

>=14.0.0, <14.3.2 || >=15.0.0, <15.1.2 · fixed in 14.3.2, 15.1.2

XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

• Cross-site scripting (XSS)

>=14.0.0, <14.3.2 || >=15.0.0, <15.1.2 · fixed in 14.3.2, 15.1.2

Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability

• CWE-126

>=8.0.0, <8.0.12 || >=9.0.0, <9.0.1 · fixed in 8.0.12, 9.0.1

Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability

• Memory corruption

>=8.0.0, <8.0.12 || >=9.0.0, <9.0.1 · fixed in 8.0.12, 9.0.1

Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability

• Memory corruption

>=9.0.0, <9.0.1 · fixed in 9.0.1

Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length

• CWE-20
• CWE-602

<10.5.7 || >=11.0.0-rc1, <13.2.2 || >=14.0.0-beta001, <14.1.2 · fixed in 10.5.7, 13.2.2, 14.1.2

Git Credential Manager carriage-return character in remote URL allows malicious repository to leak credentials

• Information disclosure
• CWE-436

<2.6.1 · fixed in 2.6.1

The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package

• Other injection
• CWE-1395

<1.5.0 · fixed in 1.5.0

Piranha CMS Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<=11.1.0 · no fixed version yet

Piranha CMS Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<=11.1.0 · no fixed version yet

Oqtane Framework Insecure Direct Object Reference vulnerability

• Broken access control

<=6.0.0 · no fixed version yet

Oqtane Framework Incorrect Access Control vulnerability

• Authentication bypass

<=6.0.0 · no fixed version yet

Oqtane Framework Insecure Direct Object Reference vulnerability

• Broken access control

<=6.0.0 · no fixed version yet

TShock Security Escalation Exploit

• Authentication bypass
• Broken access control

>=4.3.21, <5.2.1 · fixed in 5.2.1

Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications

• CWE-385

<2024.11.26 · fixed in 2024.11.26

DotNetZip Directory Traversal vulnerability

• Path traversal

>=1.10.1, <=1.16.0 · no fixed version yet

.NET Remote Code Execution Vulnerability

• Memory corruption

<9.0.0 · fixed in 9.0.0

.NET Denial of Service Vulnerability

• CWE-409
• CWE-606

<9.0.0 · fixed in 9.0.0

Duplicate Advisory: .NET and Visual Studio Denial of Service Vulnerability

• CWE-409
• CWE-606

<9.0.0 · fixed in 9.0.0

Duplicate Advisory: .NET and Visual Studio Remote Code Execution Vulnerability

• Memory corruption

<9.0.0 · fixed in 9.0.0

HTTP Client uses incorrect token after refresh

• Privilege escalation

>=3.0.0, <3.0.1 · fixed in 3.0.1

CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

• Other injection

<7.2.22 · fixed in 7.2.22

Duplicate Advisory: Umbraco CMS Cross-site Scripting vulnerability

• Cross-site scripting (XSS)
• CWE-707

<=12.3.6 · no fixed version yet

Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability

• Insecure deserialization

>=4.8.0-beta00005, <4.8.0-beta00017 · fixed in 4.8.0-beta00017

ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected

• Broken access control

<8.0.0 · fixed in 8.0.0

Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

• Authentication bypass

>=7.0.0, <7.0.8 · fixed in 7.0.8

MPXJ has a Potential Path Traversal Vulnerability

• Path traversal

>=8.3.5, <13.5.1 · fixed in 13.5.1

Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out

• Authentication bypass

>=10.0.0, <10.8.7 || >=13.0.0, <13.5.2 · fixed in 10.8.7, 13.5.2

Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

• Other injection

>=10.0.0, <10.8.7 || >=13.0.0, <13.5.2 · fixed in 10.8.7, 13.5.2

Umbraco CMS logout page displayed before session expiration

• Authentication bypass

>=10.0.0, <10.8.7 || >=13.0.0, <13.5.2 · fixed in 10.8.7, 13.5.2

Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API

• Broken access control

>=14.0.0, <14.3.0 · fixed in 14.3.0