NuGet Advisories.

CliInvoke: Argument Injection in Extensibility Runner Factory

• Command injection

>=2.0.0, <2.8.5 || >=2.9.0, <2.9.4 || >=2.10.0, <2.10.5 || >=3.0.0-alpha.1, <3.0.0-beta.2 · fixed in 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.2

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

• Path traversal

>=7.3.0, <16.5.0 · fixed in 16.5.0

MPXJ: XXE Vulnerability in MerlinReader

• XML external entities (XXE)

>=5.5.5, <16.4.1 · fixed in 16.4.1

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

• Authentication bypass
• Weak cryptography or TLS

<4.3.0 · fixed in 4.3.0

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

• CWE-755

>=4.0.0, <4.3.0 · fixed in 4.3.0

Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

• CWE-755

>=4.0.0, <4.3.0 · fixed in 4.3.0

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

• Information disclosure

<4.3.0 · fixed in 4.3.0

SSH.NET: ScpClient allows server-side RCE via default SCP path handling

• Command injection

<2026.0.0 · fixed in 2026.0.0

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

• Information disclosure
• Broken access control

>=12.0.0, <13.15.1 || >=14.0.0-rc1, <17.5.3 || >=18.0.0, <18.0.2 · fixed in 13.15.1, 17.5.3, 18.0.2

Marten's LINQ provider has SQL injection via unescaped string literals

• SQL injection

>=7.0.0, <9.13.0 · fixed in 9.13.0

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

• CWE-426

<1.16.0-beta.2 · fixed in 1.16.0-beta.2

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

• CWE-409

>=8.0.0, <8.0.31 || >=9.0.0, <9.0.20 || >=10.0.0, <10.0.12 || >=11.0.0-preview.1, <11.0.0-rc.1 · fixed in 8.0.31, 9.0.20, 10.0.12, 11.0.0-rc.1

Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability

• Memory corruption

>=17.10.0-beta1.24272.1, <18.9.0-beta1.26405.2 · fixed in 18.9.0-beta1.26405.2

Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability

• Memory corruption

>=17.10.0-beta1.24272.1, <18.9.0-beta1.26405.2 · fixed in 18.9.0-beta1.26405.2

Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability

• Memory corruption

>=17.10.0-beta1.24272.1, <18.9.0-beta1.26405.2 · fixed in 18.9.0-beta1.26405.2

Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability

• Insecure deserialization
• CWE-693

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

Microsoft QUIC: Remote Code Execution Vulnerability

• Memory corruption

<2.4.19 || >=2.5.3, <2.5.10 · fixed in 2.4.19, 2.5.10

Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability

• CWE-212

>=10.0.102, <10.0.111 || >=10.0.200, <=10.0.204 || >=10.0.300, <10.0.303 · fixed in 10.0.111, 10.0.303

Duplicate Advisory: Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability

• Memory corruption

>=17.10.0-beta1.24272.1, <18.9.0-beta1.26405.2 · fixed in 18.9.0-beta1.26405.2

Duplicate Advisory: Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability

• Memory corruption

>=17.10.0-beta1.24272.1, <18.9.0-beta1.26405.2 · fixed in 18.9.0-beta1.26405.2

Duplicate Advisory: Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability

• Memory corruption

>=17.10.0-beta1.24272.1, <18.9.0-beta1.26405.2 · fixed in 18.9.0-beta1.26405.2

Duplicate Advisory: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

• CWE-409

>=8.0.0, <8.0.31 || >=9.0.0, <9.0.20 || >=10.0.0, <10.0.12 || >=11.0.0-preview.1, <11.0.0-rc.1 · fixed in 8.0.31, 9.0.20, 10.0.12, 11.0.0-rc.1

ImageMagick: Memory Leak when providing invalid options to the cli

• Denial of service

<14.15.0 · fixed in 14.15.0

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

• CWE-248
• CWE-755

>=10.0.5, <10.0.14 · fixed in 10.0.14

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

• Memory corruption
• CWE-755

<10.0.14 · fixed in 10.0.14

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

• Path traversal

<2026.0.0 · fixed in 2026.0.0

Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability

• Server-side request forgery (SSRF)
• CWE-693

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability

• Memory corruption

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability

• Memory corruption

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability

• Memory corruption

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability

• CWE-248
• CWE-252

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

• Memory corruption

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

• CWE-606

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability

• HTTP request smuggling

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

Duplicate Advisory: Microsoft QUIC Remote Code Execution Vulnerability

• Memory corruption

* · no fixed version yet

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

• Memory corruption

>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

• Memory corruption
• CWE-681

<14.15.0 · fixed in 14.15.0

Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

• Memory corruption
• CWE-20

>=8.0.0, <8.0.3 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.3, 9.0.15, 10.0.6

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

• CWE-20
• CWE-755

<10.0.9 · fixed in 10.0.9

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

• Weak cryptography or TLS
• CWE-682

<2.253.0 · fixed in 2.253.0

ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

• Memory corruption

<14.15.0 · fixed in 14.15.0

ImageMagick: Heap Buffer Over-Write in fx operation

• Memory corruption

<14.15.0 · fixed in 14.15.0

ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

• Memory corruption

<14.15.0 · fixed in 14.15.0

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

• Path traversal
• CWE-829

<1.29.1 || >=1.30.0, <1.34.0 · fixed in 1.29.1, 1.34.0

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

• Path traversal
• Code injection

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

• Code injection
• CWE-829

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

• Path traversal
• Server-side request forgery (SSRF)

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

• Path traversal
• Server-side request forgery (SSRF)

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

• Path traversal
• CWE-829

<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5

Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator

• Code injection

<1.29.1 || >=1.30.0, <1.32.4 · fixed in 1.29.1, 1.32.4

Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

• Code injection

<1.29.1 || >=1.30.0, <1.32.0 · fixed in 1.29.1, 1.32.0

Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

• Code injection

<1.29.1 || >=1.30.0, <1.32.0 · fixed in 1.29.1, 1.32.0

ImageMagick: Heap Buffer Over-Write in X11 import with crafted window title

• Memory corruption

<14.15.0 · fixed in 14.15.0

Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

• Code injection

<1.29.1 || >=1.30.0, <1.32.3 · fixed in 1.29.1, 1.32.3

ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in ICON decoder when allocation fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory leak in VIFF encoder when allocation fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in MIFF encoder when allocaton fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in YUV decoder when opening of blob fails

• Denial of service

<14.15.0 · fixed in 14.15.0

ImageMagick: Memory Leak in TIFF encoder when an allocation fails

• Denial of service

<14.15.0 · fixed in 14.15.0