Advisories · .NET
NuGet Advisories.
Every NuGet Advisory we hold, newest first.
- CVSS 2.1 Low
ImageMagick: Memory Leak in JNG encoder when a blob could not be opened
- Denial of service
<14.15.0 · fixed in 14.15.0
GHSA-99w9-hv66-rfv7 · CVE-2026-61866 - CVSS 2.1 Low
ImageMagick: Memory Leak in hough lines operation when an operation fails
- Denial of service
<14.15.0 · fixed in 14.15.0
GHSA-j8rh-v2r8-v94x · CVE-2026-61865 - CVSS 2.1 Low
ImageMagick: Memory Leak in color transformation to log colorspace when operation fails
- Denial of service
<14.15.0 · fixed in 14.15.0
GHSA-7c7m-fpjw-gwcq · CVE-2026-61864 - CVSS 2.1 Low
ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.
- Denial of service
<14.15.0 · fixed in 14.15.0
GHSA-6vxp-gfwf-hcr9 · CVE-2026-61863 - CVSS 2.1 Low
ImageMagick: Information Disclosure when printing profiles with debug enabled
- Memory corruption
- CWE-193
<14.15.0 · fixed in 14.15.0
GHSA-hwf3-r46v-5ggx · CVE-2026-61862 - CVSS 6.3 Medium
ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails
- Memory corruption
<14.15.0 · fixed in 14.15.0
GHSA-qvxh-prvr-85w2 · CVE-2026-61861 - CVSS 6.3 Medium
ImageMagick: Use-After-Free when freetype initialization fails
- Memory corruption
<14.15.0 · fixed in 14.15.0
GHSA-6jwg-7q3p-5fqm · CVE-2026-61860 - CVSS 4.8 Medium
ImageMagick: Policy Bypass in script operation due to missing checks
- Path traversal
- Broken access control
<14.15.0 · fixed in 14.15.0
GHSA-vghg-5jrg-2398 · CVE-2026-61859 - CVSS 4.8 Medium
ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check
- Path traversal
- Broken access control
<14.15.0 · fixed in 14.15.0
GHSA-v3j6-27vc-7pw2 · CVE-2026-61858 - CVSS 6.3 Medium
ImageMagick: Heap-use-after-free via XMP profile could result in a crash
- Denial of service
- Memory corruption
<14.15.0 · fixed in 14.15.0
GHSA-qh5g-q395-cx4j · CVE-2026-61857 - CVSS 5.7 Medium
ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797
- Cross-site scripting (XSS)
- CWE-116
<14.10.3 · fixed in 14.10.3
GHSA-hc76-7mpc-qjqh - CVSS 4.7 Medium
ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
- Path traversal
- Race condition
<14.15.0 · fixed in 14.15.0
GHSA-56m6-8q75-f2rw - CVSS 4.8 Medium
ImageMagick: Policy Bypass possible with matrix-backed operations
- Broken access control
- Denial of service
<14.15.0 · fixed in 14.15.0
GHSA-rvhp-75f6-9jqh · CVE-2026-61465 - CVSS 5.5 Medium
ImageMagick: Policy Bypass in concatenate operation due to missing checks
- Path traversal
- Broken access control
<14.15.0 · fixed in 14.15.0
GHSA-82mp-vp5c-9pf7 · CVE-2026-55628 - CVSS 5.5 Medium
ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
- Memory corruption
- CWE-682
<14.15.0 · fixed in 14.15.0
GHSA-c4v7-w88g-m6c4 · CVE-2026-55597 - CVSS 4.7 Medium
ImageMagick: Infinite Loop in connected-components when providing invalid arguments
- Denial of service
<14.15.0 · fixed in 14.15.0
GHSA-qhmf-7fc4-8q3h · CVE-2026-55595 - CVSS 5.3 Medium
ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
- Denial of service
<14.15.0 · fixed in 14.15.0
GHSA-mx48-2qq3-23hf · CVE-2026-55594 - CVSS 5.5 Medium
ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
- Memory corruption
<14.15.0 · fixed in 14.15.0
GHSA-ff5c-8x9r-8qcw · CVE-2026-55510 - CVSS 5.3 Medium
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
- Information disclosure
- Memory corruption
<14.15.0 · fixed in 14.15.0
GHSA-8g53-9m3c-69xg · CVE-2026-53467 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
- Denial of service
>=8.0.0, <8.0.26 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.26, 9.0.15, 10.0.6
GHSA-j8gr-8fp3-5q5h · CVE-2026-56170 - CVSS 7.0 High
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
- Path traversal
- CWE-345
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-55jh-fwmh-39m4 · CVE-2026-50526 - CVSS 8.8 High
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
- Authentication bypass
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-8prm-248r-h957 · CVE-2026-47300 - CVSS 8.8 High
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability
- Other injection
- Broken access control
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-2p3q-h3hg-jcqq · CVE-2026-47303 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
- Memory corruption
>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10
GHSA-mmjf-rqrv-855v · CVE-2026-50527 - CVSS 7.8 High
Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
- Code injection
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-2969-4q4w-w5h3 · CVE-2026-50650 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
- Denial of service
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-wp74-jgxh-gv4q · CVE-2026-50651 - CVSS 6.5 Medium
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
- CWE-116
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-74jp-vm22-8q8x · CVE-2026-50659 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
- Denial of service
>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10
GHSA-8q5v-6pqq-x66h · CVE-2026-50525 - CVSS 8.2 High
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
- Broken access control
- CWE-302
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-qvw7-jm5c-6hqw · CVE-2026-50528 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
- Denial of service
>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10
GHSA-23rf-6693-g89p · CVE-2026-50648 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
- CWE-1287
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-w7cw-xp7h-6j5j · CVE-2026-50524 - CVSS 8.1 High
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
- Weak cryptography or TLS
- CWE-345
>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10
GHSA-g8r8-53c2-pm3f · CVE-2026-47304 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
- Denial of service
>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.4, 9.0.18, 10.0.10
GHSA-cvvh-rhrc-wg4q · CVE-2026-47302 - CVSS 7.5 High
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
- Memory corruption
>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10
GHSA-rp2p-6cmp-jxj9 · CVE-2026-57108 - CVSS 6.9 Medium
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
- Cross-site scripting (XSS)
<1.5.0 · fixed in 1.5.0
GHSA-pgww-w46g-26qg · CVE-2026-54570 - CVSS 7.5 High
Prompty: Arbitrary file read via file reference expansion
- Path traversal
- Information disclosure
<2.0.0b2 · fixed in 2.0.0b2
GHSA-wxhm-2mq7-7697 · CVE-2026-53598 - CVSS 7.5 High
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
- Denial of service
<3.43.0 · fixed in 3.43.0
GHSA-38wr-vpc7-2mp4 · CVE-2026-50273 - CVSS 4.9 Medium
Umbraco.AI discloses sensitive application configuration values
- Information disclosure
<1.14.0 · fixed in 1.14.0
GHSA-q3v2-xj35-9grx - CVSS 9.3 CriticalCritical · CVSS 9+
Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)
- Broken access control
<7.2.2 · fixed in 7.2.2
GHSA-7jvp-hj45-2f2m · CVE-2026-73061 - CVSS 1.9 Low
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
- Weak cryptography or TLS
- CWE-256
>=4.0.0, <4.2.0 · fixed in 4.2.0
GHSA-4j9m-h44m-2hv8 · CVE-2026-50268 - CVSS 4.7 Medium
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
- Information disclosure
- Broken access control
>=4.0.0, <4.2.0 · fixed in 4.2.0
GHSA-rxrh-4j9h-xgg9 · CVE-2026-50267 - CVSS 5.9 Medium
Steeltoe's static JWKS cache shared across schemes and never invalidated
- Information disclosure
<4.2.0 · fixed in 4.2.0
GHSA-7fqc-p256-7pwj · CVE-2026-50202 - CVSS 6.5 Medium
Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
- Privilege escalation
- Broken access control
<4.2.0 · fixed in 4.2.0
GHSA-227r-jm2g-7cp4 · CVE-2026-50201 - CVSS 7.5 High
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
- Information disclosure
- Weak cryptography or TLS
<4.2.0 · fixed in 4.2.0
GHSA-q62h-354g-5r85 · CVE-2026-50200 - CVSS 7.5 High
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
- Denial of service
- CWE-20
<3.4.0 || >=4.0.0, <4.2.0 · fixed in 3.4.0, 4.2.0
GHSA-j8ph-6fxj-g533 · CVE-2026-50196 - CVSS 8.2 High
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
- Authentication bypass
- Broken access control
<4.2.0 · fixed in 4.2.0
GHSA-58f6-6rj2-3v8r · CVE-2026-50194 - CVSS 5.3 Medium
CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
- Path traversal
<148.0.90 · fixed in 148.0.90
GHSA-85jm-cwp2-mvpv · CVE-2026-48796 - CVSS 7.5 High
Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
- Denial of service
>=2.0.0-preview.11, <2.7.5 || >=3.0.0, <3.5.4 · fixed in 2.7.5, 3.5.4
GHSA-v5pm-xwqc-g5wc · CVE-2026-49451 - CVSS 6.2 Medium
ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image
- Memory corruption
<14.14.0 · fixed in 14.14.0
GHSA-44cp-c3ww-9rv5 · CVE-2026-53465 - CVSS 4.0 Medium
ImageMagick: Memory Leak in wand option parser when providing invalid arguments
- Denial of service
<14.14.0 · fixed in 14.14.0
GHSA-j989-f892-2335 · CVE-2026-53464 - CVSS 8.7 High
Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)
- Denial of service
>=6.6.0, <7.2.1 · fixed in 7.2.1
GHSA-6q7j-xr26-3h2c · CVE-2026-74783 - CVSS 8.7 High
Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx
- Denial of service
>=3.0.0, <7.2.1 · fixed in 7.2.1
GHSA-q6rr-fm2g-g5x8 · CVE-2026-73062 - CVSS 4.3 Medium
ImageMagick has Null Pointer Dereference caused by the distort operation when passing incorrect arguments
- Memory corruption
<14.14.0 · fixed in 14.14.0
GHSA-p9rq-q46c-g4x6 · CVE-2026-53463 - CVSS 5.9 Medium
ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails
- Memory corruption
<14.14.0 · fixed in 14.14.0
GHSA-px7q-ggqj-hcf2 · CVE-2026-53462 - CVSS 7.5 High
ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop
- Memory corruption
<14.14.0 · fixed in 14.14.0
GHSA-g22q-f7gc-5jhr · CVE-2026-53461 - CVSS 7.5 High
ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
- Denial of service
<14.14.0 · fixed in 14.14.0
GHSA-q62c-h75r-2xhc · CVE-2026-53460 - CVSS 5.5 Medium
ImageMagick: Policy Bypass can read disallowed files via symlink
- Path traversal
- Command injection
<14.14.0 · fixed in 14.14.0
GHSA-xcjm-wqff-m669 · CVE-2026-49219 - CVSS 7.5 High
ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
- CWE-20
- CWE-1284
<14.14.0 · fixed in 14.14.0
GHSA-8pj9-6897-74xc · CVE-2026-49218 - CVSS 5.9 Medium
ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems
- Memory corruption
<14.14.0 · fixed in 14.14.0
GHSA-4v89-6mgq-6rgc · CVE-2026-48994 - CVSS 5.5 Medium
ImageMagick Vulnerable to Stack Overflow in its MVG Decoder
- Denial of service
<14.14.0 · fixed in 14.14.0
GHSA-h36c-3666-h489 · CVE-2026-48734