NuGet package vulnerabilities
The newest vulnerabilities affecting NuGet packages, up to 200. Subscribe by RSS.
- GHSA-473Q-M89C-GHF8MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificatMySqlConnector
- CVE-2026-116675TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationtinymce · tinymce/tinymce
- CVE-2026-92707MessagePack: Nested arrays can blow past buffer length limitsMessagePack-CSharp · MessagePack
- CVE-2026-88092ASP.NET Core Tampering VulnerabilityMicrosoft ASP.NET Core · Microsoft Visual Studio +12
- CVE-2026-106118ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB writeSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-106117ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharpSixLabors ImageSharp · ImageSharp
- CVE-2026-106116ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loopSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-106115ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output bufferSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-106114ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-106113ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-106112ImageSharp: ICC LUT16 output channel count can write beyond Vector4SixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-106111ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflateSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-106110ImageSharp: TIFF CCITT T4 encoder can write past its compressed output bufferSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2026-105796Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generatorsmicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-105795Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsmicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-105794MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLmicrosoft msquic · Microsoft.Native.Quic.MsQuic.OpenSSL
- CVE-2026-100369CliInvoke: Argument Injection in Extensibility Runner Factoryalastairlundy CliInvoke · AlastairLundy.CliInvoke +1
- CVE-2026-100368CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappersalastairlundy CliInvoke.Specializations · CliInvoke.Spec… +1
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderjoniles mpxj · net.sf.mpxj:mpxj +5
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersjoniles mpxj · MPXJ.Net +5
- CVE-2026-69197Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionUmbraco-CMS · Umbraco.Cms
- CVE-2026-81515Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)SteeltoeOSS security-advisories · Steeltoe.Discovery.Eureka
- CVE-2026-81516Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)SteeltoeOSS security-advisories · Steeltoe.Discovery.Consul
- CVE-2026-81868Steeltoe: Header-forwarded client cert lacks proof of private-key possessionSteeltoeOSS security-advisories · Steeltoe.Security.Authori…
- CVE-2026-75523Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secretsSteeltoeOSS security-advisories · Steeltoe.Management.Endpo…
- CVE-2026-75513Marten: SQL injection in Marten's LINQ provider via unescaped string literalsJasperFx marten · Marten
- CVE-2026-85756SSH.NET: ScpClient allows server-side RCE via default SCP path handlingsshnet SSH.NET · SSH.NET
- CVE-2026-54632SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)sipsorcery-org sipsorcery · SIPSorcery
- CVE-2026-81192OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSopen-telemetry opentelemetry-dotnet-contrib · OpenTelemetry…
- CVE-2026-71328.NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft Visual Studio +3
- CVE-2026-69304ASP.NET Core Denial of Service VulnerabilityMicrosoft .NET · Microsoft ASP.NET Core +5
- CVE-2026-69439.NET and Visual Studio Elevation of Privilege VulnerabilityMicrosoft .NET · Microsoft Visual Studio +3
- CVE-2026-72923Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansionmicrosoft OpenAPI.NET · Microsoft.OpenApi.YamlReader +1
- CVE-2026-69522.NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft Visual Studio +1
- CVE-2026-48796CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folderCefSharp · CefSharp.Common
- CVE-2026-54570AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point BypassAngleSharp
- CVE-2026-48798SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenamessshnet SSH.NET · SSH.NET
- CVE-2026-73851Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)microsoft kiota · Microsoft.OpenApi.Kiota
- CVE-2026-74795Scriban before 6.6.0 Denial of Service via Uncontrolled Recursionscriban · Scriban.Signed
- CVE-2026-74794Scriban before 6.6.0 Denial of Service via Infinite Recursionscriban · Scriban.Signed
- CVE-2026-74792Scriban before 7.0.0 Stack Overflow via nested array initializersscriban · Scriban.Signed
- CVE-2026-74791Scriban before 7.0.0 Authorization Bypass via Stale Include Cachescriban · Scriban.Signed
- CVE-2026-74790Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cachescriban · Scriban.Signed
- CVE-2026-74789Scriban before 7.0.0 LoopLimit Bypass via Built-in Operationsscriban · Scriban.Signed
- CVE-2026-74788Scriban before 7.0.0 Denial of Service via string.pad_left/pad_rightscriban · Scriban.Signed
- CVE-2026-74787Scriban before 7.0.0 Uncontrolled Recursion via object.to_jsonscriban · Scriban.Signed
- CVE-2026-74786Scriban before 7.0.0 Denial of Service via Unbounded Template Outputscriban · Scriban.Signed
- CVE-2026-74785Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumptionscriban · Scriban.Signed
- CVE-2026-74784Scriban before 7.2.0 Denial of Service via array.insert_atscriban · Scriban.Signed
- CVE-2026-74783Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Servicescriban · Scriban.Signed
- CVE-2026-73062Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplicationscriban · Scriban.Signed
- CVE-2026-73061Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessorscriban
- CVE-2026-62898Microsoft QUIC Information Disclosure VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +7
- CVE-2026-70354.NET Core Remote Code Execution VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8
- CVE-2026-62886.NET Elevation of Privilege VulnerabilityMicrosoft .NET Framework · Microsoft Visual Studio +5
- CVE-2026-62902.NET Information Disclosure VulnerabilityMicrosoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +6
- CVE-2026-62897.NET Framework Remote Code Execution VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8
- CVE-2026-62946ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit buildsImageMagick · Magick.NET-Q16-AnyCPU +5
- CVE-2026-62363ImageMagick: Heap Buffer Over-Write in fx operationImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-62343ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is providedImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-66011ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI OptionsImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-45785OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycleopenmcdf
- CVE-2026-55254NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluationncalc · NCalc.Core +1
- CVE-2026-50273Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoSDataDog dd-trace-dotnet · Datadog.Trace +1
- CVE-2026-53598Prompty: Arbitrary File Read via ${file:path} Reference Expansionmicrosoft prompty · prompty +2
- CVE-2026-59867Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refmicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-59866Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNamemicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-59864Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensionsmicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-59865Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`microsoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-59863Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRFmicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-59859Kiota: Code Generation Literal Injection in the PHP Generatormicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-59862Kiota: Code Generation Literal Injection in the Python Generatormicrosoft kiota · Microsoft.OpenAPI.Kiota +1
- CVE-2026-59861Kiota: Code Generation Literal Injection in Kiota Ruby Generatormicrosoft kiota · Microsoft.OpenAPI.Kiota +1
- CVE-2026-59860Kiota: XML Doc-Comment Newline Breakout Code Injectionmicrosoft kiota · Microsoft.OpenApi.Kiota +1
- CVE-2026-61872ImageMagick before 7.1.2-26 Memory Leak via TIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61871ImageMagick before 7.1.2-26 Memory Leak in ICON decoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61869ImageMagick before 7.1.2-26 Memory Leak in MIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61868ImageMagick before 7.1.2-26 Memory Leak in YUV DecoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61867ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61866ImageMagick before 7.1.2-26 Memory Leak in JNG encoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61865ImageMagick before 7.1.2-26 Memory Leak in Hough LinesImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61864ImageMagick before 7.1.2-26 Memory Leak in Log ColorspaceImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61863ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61862ImageMagick before 7.1.2-26 Information Disclosure via identifyImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61860ImageMagick before 7.1.2-26 Use-After-Free via freetypeImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61859ImageMagick before 7.1.2-26 Policy Bypass via script operationImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61464ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11ImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56375ImageMagick - Memory Leak in ASHLAR Coder Action FailureImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-50659.NET Spoofing VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +15
- CVE-2026-50651.NET Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14
- CVE-2026-50650.NET Framework Elevation of Privilege VulnerabilityMicrosoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7
- CVE-2026-50648.NET Framework Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4
- CVE-2026-50646.NET Framework Remote Code Execution VulnerabilityMicrosoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7
- CVE-2026-50528.NET Security Feature Bypass VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14
- CVE-2026-50527.NET Framework Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4
- CVE-2026-50526.NET Tampering VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3
- CVE-2026-50525.NET Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4
- CVE-2026-50524.NET Framework Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14
- CVE-2026-47304.NET Security Feature Bypass VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4
- CVE-2026-47303ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3
- CVE-2026-47302.NET Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +16
- CVE-2026-47300ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3
- CVE-2026-57108.NET Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +9
- CVE-2026-56170ASP.NET Core Denial of Service VulnerabilityMicrosoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +13
- CVE-2026-61870ImageMagick before 7.1.2-26 Memory Leak via VIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61861ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaptionImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61858ImageMagick before 7.1.2-26 Policy Bypass via APNG encoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61857ImageMagick before 7.1.2-26 Heap Use-After-Free via XMPImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61465ImageMagick before 7.1.2-26 Memory Allocation Policy BypassImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56372ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify MethodImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56373ImageMagick - Use-After-Free Write in PDB DecoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56366ImageMagick - Memory Leak in META Reader APP1JPEG Error PathImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-54782CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validationCoreWCF · CoreWCF.Primitives
- CVE-2026-54781CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforcedCoreWCF · CoreWCF.Primitives
- CVE-2026-54784CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentialityCoreWCF · CoreWCF.Primitives
- CVE-2026-54774CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificateCoreWCF · CoreWCF.Primitives
- CVE-2026-54783CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messagesCoreWCF · CoreWCF.Primitives
- CVE-2026-54780CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite BypassCoreWCF · CoreWCF.Primitives
- CVE-2026-54775CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.CoreWCF · CoreWCF.Kafka
- CVE-2026-54778CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity ResolutionCoreWCF · CoreWCF.UnixDomainSocket
- CVE-2026-54773CoreWCF: WS-Security signature substitution via document-wide Signature lookupCoreWCF · CoreWCF.Primitives
- CVE-2026-54779CoreWCF: SAML token replay protection is inoperativeCoreWCF · CoreWCF.Primitives
- CVE-2026-54772CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshakeCoreWCF · CoreWCF.NetFramingBase
- CVE-2026-54776CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgradeCoreWCF · CoreWCF.UnixDomainSocket
- CVE-2026-54777CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instanceCoreWCF · CoreWCF.NetNamedPipe
- CVE-2026-56374ImageMagick - Heap Buffer Overflow in FTXT Encoder via format ParameterImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56362ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata DesynchronizationImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-55597ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of argumentsImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-55595ImageMagick: Infinite Loop in connected-components when providing invalid argumentsImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-55594ImageMagick: Stack Overflow in MVG decoder due to missing depth check.ImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-55510ImageMagick: Use-After-Free in crafted 8BIM when identifying an imageImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-53467ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchangedImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-53466ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflowImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-55628ImageMagick: Policy Bypass in concatenate operation due to missing checksImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56369ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImageImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56365ImageMagick - Memory Leak in PNG Encoder via MNG Image WritingImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56364ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XMLImageMagick · Magick.NET-Q8-x64 +18
- CVE-2026-56363ImageMagick - Division by Zero in Binomial Kernel ProcessingImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56361ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology ProcessingImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-49451Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsingmicrosoft OpenAPI.NET · Microsoft.OpenApi
- CVE-2026-56370ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components ArtifactImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56368ImageMagick - Memory Leak in Raw Pixel Data CodersImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56379ImageMagick - Command Injection via SVG DecoderImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56376ImageMagick - Heap Use-After-Free in Meta CoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56371ImageMagick - Memory Leak in TXT File Processing via Texture AttributeImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-48109MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad inputMessagePack-CSharp · MessagePack
- CVE-2026-48502MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsMessagePack-CSharp · MessagePack
- CVE-2026-48506MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depthMessagePack-CSharp · MessagePack
- CVE-2026-48509MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodiesMessagePack-CSharp · MessagePack
- CVE-2026-48510MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsMessagePack-CSharp · MessagePack
- CVE-2026-48511MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsMessagePack-CSharp · MessagePack
- CVE-2026-48512MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementMessagePack-CSharp · MessagePack
- CVE-2026-48513MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcementMessagePack-CSharp · MessagePack
- CVE-2026-48514MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte lengthMessagePack-CSharp · MessagePack
- CVE-2026-48515MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensionsMessagePack-CSharp · MessagePack
- CVE-2026-48516MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsMessagePack-CSharp · MessagePack
- CVE-2026-48517MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsMessagePack-CSharp · MessagePack
- CVE-2026-40372ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft ASP.NET Core · Microsoft Visual Studio +2