# cve.now: NuGet packages

The newest entries affecting NuGet packages (up to 200). To check exact package versions, use the MCP check_stack tool or /stack.

- [GHSA-473Q-M89C-GHF8](https://cve.now/GHSA-473Q-M89C-GHF8.md): MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificat (medium (no CVSS), MySqlConnector)
- [CVE-2026-116675](https://cve.now/CVE-2026-116675.md): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` serialization (CVSS 8.5, tinymce · tinymce/tinymce)
- [CVE-2026-92707](https://cve.now/CVE-2026-92707.md): MessagePack: Nested arrays can blow past buffer length limits (CVSS 5.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-88092](https://cve.now/CVE-2026-88092.md): ASP.NET Core Tampering Vulnerability (CVSS 9.4, Microsoft ASP.NET Core · Microsoft Visual Studio +12)
- [CVE-2026-106118](https://cve.now/CVE-2026-106118.md): ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106117](https://cve.now/CVE-2026-106117.md): ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp (CVSS 7.5, SixLabors ImageSharp · ImageSharp)
- [CVE-2026-106116](https://cve.now/CVE-2026-106116.md): ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106115](https://cve.now/CVE-2026-106115.md): ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106114](https://cve.now/CVE-2026-106114.md): ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106113](https://cve.now/CVE-2026-106113.md): ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106112](https://cve.now/CVE-2026-106112.md): ImageSharp: ICC LUT16 output channel count can write beyond Vector4 (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106111](https://cve.now/CVE-2026-106111.md): ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate (CVSS 5.9, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-106110](https://cve.now/CVE-2026-106110.md): ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2026-105796](https://cve.now/CVE-2026-105796.md): Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators (CVSS 8.8, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-105795](https://cve.now/CVE-2026-105795.md): Kiota: Unsafe oauth\_card\_path references in Kiota-generated API plugin manifests (CVSS 3.1, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-105794](https://cve.now/CVE-2026-105794.md): MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL (CVSS 9.1, microsoft msquic · Microsoft.Native.Quic.MsQuic.OpenSSL)
- [CVE-2026-100369](https://cve.now/CVE-2026-100369.md): CliInvoke: Argument Injection in Extensibility Runner Factory (CVSS 8.4, alastairlundy CliInvoke · AlastairLundy.CliInvoke +1)
- [CVE-2026-100368](https://cve.now/CVE-2026-100368.md): CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers (CVSS 8.4, alastairlundy CliInvoke.Specializations · CliInvoke.Spec… +1)
- [CVE-2026-61570](https://cve.now/CVE-2026-61570.md): MPXJ: XXE Vulnerability in MerlinReader (CVSS 7.5, joniles mpxj · net.sf.mpxj:mpxj +5)
- [CVE-2026-65829](https://cve.now/CVE-2026-65829.md): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (CVSS 5.3, joniles mpxj · MPXJ.Net +5)
- [CVE-2026-69197](https://cve.now/CVE-2026-69197.md): Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion (CVSS 8.7, Umbraco-CMS · Umbraco.Cms)
- [CVE-2026-81515](https://cve.now/CVE-2026-81515.md): Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) (CVSS 7.5, SteeltoeOSS security-advisories · Steeltoe.Discovery.Eureka)
- [CVE-2026-81516](https://cve.now/CVE-2026-81516.md): Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) (CVSS 7.5, SteeltoeOSS security-advisories · Steeltoe.Discovery.Consul)
- [CVE-2026-81868](https://cve.now/CVE-2026-81868.md): Steeltoe: Header-forwarded client cert lacks proof of private-key possession (CVSS 6.5, SteeltoeOSS security-advisories · Steeltoe.Security.Authori…)
- [CVE-2026-75523](https://cve.now/CVE-2026-75523.md): Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets (CVSS 5.9, SteeltoeOSS security-advisories · Steeltoe.Management.Endpo…)
- [CVE-2026-75513](https://cve.now/CVE-2026-75513.md): Marten: SQL injection in Marten's LINQ provider via unescaped string literals (CVSS 9.1, JasperFx marten · Marten)
- [CVE-2026-85756](https://cve.now/CVE-2026-85756.md): SSH.NET: ScpClient allows server-side RCE via default SCP path handling (CVSS 7.5, sshnet SSH.NET · SSH.NET)
- [CVE-2026-54632](https://cve.now/CVE-2026-54632.md): SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) (CVSS 7.5, sipsorcery-org sipsorcery · SIPSorcery)
- [CVE-2026-81192](https://cve.now/CVE-2026-81192.md): OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS (CVSS 7.0, open-telemetry opentelemetry-dotnet-contrib · OpenTelemetry…)
- [CVE-2026-71328](https://cve.now/CVE-2026-71328.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET · Microsoft Visual Studio +3)
- [CVE-2026-69304](https://cve.now/CVE-2026-69304.md): ASP.NET Core Denial of Service Vulnerability (CVSS 5.9, Microsoft .NET · Microsoft ASP.NET Core +5)
- [CVE-2026-69439](https://cve.now/CVE-2026-69439.md): .NET and Visual Studio Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET · Microsoft Visual Studio +3)
- [CVE-2026-72923](https://cve.now/CVE-2026-72923.md): Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion (CVSS 7.5, microsoft OpenAPI.NET · Microsoft.OpenApi.YamlReader +1)
- [CVE-2026-69522](https://cve.now/CVE-2026-69522.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET · Microsoft Visual Studio +1)
- [CVE-2026-48796](https://cve.now/CVE-2026-48796.md): CefSharp: \`FolderSchemeHandlerFactory\` path boundary check can expose files outside the configured root folder (CVSS 5.3, CefSharp · CefSharp.Common)
- [CVE-2026-54570](https://cve.now/CVE-2026-54570.md): AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass (CVSS 6.9, AngleSharp)
- [CVE-2026-48798](https://cve.now/CVE-2026-48798.md): SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames (CVSS 7.1, sshnet SSH.NET · SSH.NET)
- [CVE-2026-73851](https://cve.now/CVE-2026-73851.md): Kiota: Path traversal in generated plugin manifest static\_template.file reference (percent-encoding bypass) (CVSS 6.1, microsoft kiota · Microsoft.OpenApi.Kiota)
- [CVE-2026-74795](https://cve.now/CVE-2026-74795.md): Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74794](https://cve.now/CVE-2026-74794.md): Scriban before 6.6.0 Denial of Service via Infinite Recursion (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74792](https://cve.now/CVE-2026-74792.md): Scriban before 7.0.0 Stack Overflow via nested array initializers (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74791](https://cve.now/CVE-2026-74791.md): Scriban before 7.0.0 Authorization Bypass via Stale Include Cache (CVSS 9.2, scriban · Scriban.Signed)
- [CVE-2026-74790](https://cve.now/CVE-2026-74790.md): Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache (CVSS 9.3, scriban · Scriban.Signed)
- [CVE-2026-74789](https://cve.now/CVE-2026-74789.md): Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74788](https://cve.now/CVE-2026-74788.md): Scriban before 7.0.0 Denial of Service via string.pad\_left/pad\_right (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74787](https://cve.now/CVE-2026-74787.md): Scriban before 7.0.0 Uncontrolled Recursion via object.to\_json (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74786](https://cve.now/CVE-2026-74786.md): Scriban before 7.0.0 Denial of Service via Unbounded Template Output (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74785](https://cve.now/CVE-2026-74785.md): Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption (CVSS 7.1, scriban · Scriban.Signed)
- [CVE-2026-74784](https://cve.now/CVE-2026-74784.md): Scriban before 7.2.0 Denial of Service via array.insert\_at (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-74783](https://cve.now/CVE-2026-74783.md): Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73062](https://cve.now/CVE-2026-73062.md): Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication (CVSS 8.7, scriban · Scriban.Signed)
- [CVE-2026-73061](https://cve.now/CVE-2026-73061.md): Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor (CVSS 9.3, scriban)
- [CVE-2026-62898](https://cve.now/CVE-2026-62898.md): Microsoft QUIC Information Disclosure Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +7)
- [CVE-2026-70354](https://cve.now/CVE-2026-70354.md): .NET Core Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8)
- [CVE-2026-62886](https://cve.now/CVE-2026-62886.md): .NET Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET Framework · Microsoft Visual Studio +5)
- [CVE-2026-62902](https://cve.now/CVE-2026-62902.md): .NET Information Disclosure Vulnerability (CVSS 6.5, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +6)
- [CVE-2026-62897](https://cve.now/CVE-2026-62897.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.0, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8)
- [CVE-2026-62946](https://cve.now/CVE-2026-62946.md): ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds (CVSS 5.1, ImageMagick · Magick.NET-Q16-AnyCPU +5)
- [CVE-2026-62363](https://cve.now/CVE-2026-62363.md): ImageMagick: Heap Buffer Over-Write in fx operation (CVSS 5.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-62343](https://cve.now/CVE-2026-62343.md): ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided (CVSS 4.7, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-66011](https://cve.now/CVE-2026-66011.md): ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-45785](https://cve.now/CVE-2026-45785.md): OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle (CVSS 6.2, openmcdf)
- [CVE-2026-55254](https://cve.now/CVE-2026-55254.md): NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation (CVSS 4.8, ncalc · NCalc.Core +1)
- [CVE-2026-50273](https://cve.now/CVE-2026-50273.md): Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-dotnet · Datadog.Trace +1)
- [CVE-2026-53598](https://cve.now/CVE-2026-53598.md): Prompty: Arbitrary File Read via ${file:path} Reference Expansion (CVSS 7.5, microsoft prompty · prompty +2)
- [CVE-2026-59867](https://cve.now/CVE-2026-59867.md): Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref (CVSS 7.1, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59866](https://cve.now/CVE-2026-59866.md): Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59864](https://cve.now/CVE-2026-59864.md): Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-\* extensions (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59865](https://cve.now/CVE-2026-59865.md): Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by \`kiota info\` (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59863](https://cve.now/CVE-2026-59863.md): Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF (CVSS 7.0, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59859](https://cve.now/CVE-2026-59859.md): Kiota: Code Generation Literal Injection in the PHP Generator (CVSS 8.7, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59862](https://cve.now/CVE-2026-59862.md): Kiota: Code Generation Literal Injection in the Python Generator (CVSS 7.5, microsoft kiota · Microsoft.OpenAPI.Kiota +1)
- [CVE-2026-59861](https://cve.now/CVE-2026-59861.md): Kiota: Code Generation Literal Injection in Kiota Ruby Generator (CVSS 7.5, microsoft kiota · Microsoft.OpenAPI.Kiota +1)
- [CVE-2026-59860](https://cve.now/CVE-2026-59860.md): Kiota: XML Doc-Comment Newline Breakout Code Injection (CVSS 8.7, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-61872](https://cve.now/CVE-2026-61872.md): ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder (CVSS 2.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61871](https://cve.now/CVE-2026-61871.md): ImageMagick before 7.1.2-26 Memory Leak in ICON decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61869](https://cve.now/CVE-2026-61869.md): ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61868](https://cve.now/CVE-2026-61868.md): ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61867](https://cve.now/CVE-2026-61867.md): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61866](https://cve.now/CVE-2026-61866.md): ImageMagick before 7.1.2-26 Memory Leak in JNG encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61865](https://cve.now/CVE-2026-61865.md): ImageMagick before 7.1.2-26 Memory Leak in Hough Lines (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61864](https://cve.now/CVE-2026-61864.md): ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61863](https://cve.now/CVE-2026-61863.md): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61862](https://cve.now/CVE-2026-61862.md): ImageMagick before 7.1.2-26 Information Disclosure via identify (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61860](https://cve.now/CVE-2026-61860.md): ImageMagick before 7.1.2-26 Use-After-Free via freetype (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61859](https://cve.now/CVE-2026-61859.md): ImageMagick before 7.1.2-26 Policy Bypass via script operation (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61464](https://cve.now/CVE-2026-61464.md): ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11 (CVSS 1.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56375](https://cve.now/CVE-2026-56375.md): ImageMagick - Memory Leak in ASHLAR Coder Action Failure (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-50659](https://cve.now/CVE-2026-50659.md): .NET Spoofing Vulnerability (CVSS 6.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +15)
- [CVE-2026-50651](https://cve.now/CVE-2026-50651.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14)
- [CVE-2026-50650](https://cve.now/CVE-2026-50650.md): .NET Framework Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7)
- [CVE-2026-50648](https://cve.now/CVE-2026-50648.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-50646](https://cve.now/CVE-2026-50646.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7)
- [CVE-2026-50528](https://cve.now/CVE-2026-50528.md): .NET Security Feature Bypass Vulnerability (CVSS 8.2, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14)
- [CVE-2026-50527](https://cve.now/CVE-2026-50527.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-50526](https://cve.now/CVE-2026-50526.md): .NET Tampering Vulnerability (CVSS 7.0, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3)
- [CVE-2026-50525](https://cve.now/CVE-2026-50525.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-50524](https://cve.now/CVE-2026-50524.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14)
- [CVE-2026-47304](https://cve.now/CVE-2026-47304.md): .NET Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4)
- [CVE-2026-47303](https://cve.now/CVE-2026-47303.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3)
- [CVE-2026-47302](https://cve.now/CVE-2026-47302.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +16)
- [CVE-2026-47300](https://cve.now/CVE-2026-47300.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3)
- [CVE-2026-57108](https://cve.now/CVE-2026-57108.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +9)
- [CVE-2026-56170](https://cve.now/CVE-2026-56170.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +13)
- [CVE-2026-61870](https://cve.now/CVE-2026-61870.md): ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61861](https://cve.now/CVE-2026-61861.md): ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61858](https://cve.now/CVE-2026-61858.md): ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61857](https://cve.now/CVE-2026-61857.md): ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61465](https://cve.now/CVE-2026-61465.md): ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56372](https://cve.now/CVE-2026-56372.md): ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56373](https://cve.now/CVE-2026-56373.md): ImageMagick - Use-After-Free Write in PDB Decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56366](https://cve.now/CVE-2026-56366.md): ImageMagick - Memory Leak in META Reader APP1JPEG Error Path (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-54782](https://cve.now/CVE-2026-54782.md): CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation (CVSS 10.0, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54781](https://cve.now/CVE-2026-54781.md): CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54784](https://cve.now/CVE-2026-54784.md): CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54774](https://cve.now/CVE-2026-54774.md): CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54783](https://cve.now/CVE-2026-54783.md): CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages (CVSS 7.4, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54780](https://cve.now/CVE-2026-54780.md): CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass (CVSS 3.7, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54775](https://cve.now/CVE-2026-54775.md): CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service. (CVSS 6.5, CoreWCF · CoreWCF.Kafka)
- [CVE-2026-54778](https://cve.now/CVE-2026-54778.md): CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution (CVSS 6.2, CoreWCF · CoreWCF.UnixDomainSocket)
- [CVE-2026-54773](https://cve.now/CVE-2026-54773.md): CoreWCF: WS-Security signature substitution via document-wide Signature lookup (CVSS 5.9, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54779](https://cve.now/CVE-2026-54779.md): CoreWCF: SAML token replay protection is inoperative (CVSS 5.9, CoreWCF · CoreWCF.Primitives)
- [CVE-2026-54772](https://cve.now/CVE-2026-54772.md): CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake (CVSS 7.5, CoreWCF · CoreWCF.NetFramingBase)
- [CVE-2026-54776](https://cve.now/CVE-2026-54776.md): CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade (CVSS 4.4, CoreWCF · CoreWCF.UnixDomainSocket)
- [CVE-2026-54777](https://cve.now/CVE-2026-54777.md): CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance (CVSS 6.5, CoreWCF · CoreWCF.NetNamedPipe)
- [CVE-2026-56374](https://cve.now/CVE-2026-56374.md): ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56362](https://cve.now/CVE-2026-56362.md): ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-55597](https://cve.now/CVE-2026-55597.md): ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55595](https://cve.now/CVE-2026-55595.md): ImageMagick: Infinite Loop in connected-components when providing invalid arguments (CVSS 4.7, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55594](https://cve.now/CVE-2026-55594.md): ImageMagick: Stack Overflow in MVG decoder due to missing depth check. (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55510](https://cve.now/CVE-2026-55510.md): ImageMagick: Use-After-Free in crafted 8BIM when identifying an image (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53467](https://cve.now/CVE-2026-53467.md): ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53466](https://cve.now/CVE-2026-53466.md): ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow (CVSS 6.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55628](https://cve.now/CVE-2026-55628.md): ImageMagick: Policy Bypass in concatenate operation due to missing checks (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56369](https://cve.now/CVE-2026-56369.md): ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56365](https://cve.now/CVE-2026-56365.md): ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56364](https://cve.now/CVE-2026-56364.md): ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML (CVSS 1.8, ImageMagick · Magick.NET-Q8-x64 +18)
- [CVE-2026-56363](https://cve.now/CVE-2026-56363.md): ImageMagick - Division by Zero in Binomial Kernel Processing (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56361](https://cve.now/CVE-2026-56361.md): ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-49451](https://cve.now/CVE-2026-49451.md): Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing (CVSS 7.5, microsoft OpenAPI.NET · Microsoft.OpenApi)
- [CVE-2026-56370](https://cve.now/CVE-2026-56370.md): ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56368](https://cve.now/CVE-2026-56368.md): ImageMagick - Memory Leak in Raw Pixel Data Coders (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56379](https://cve.now/CVE-2026-56379.md): ImageMagick - Command Injection via SVG Decoder (CVSS 9.2, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56376](https://cve.now/CVE-2026-56376.md): ImageMagick - Heap Use-After-Free in Meta Coder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56371](https://cve.now/CVE-2026-56371.md): ImageMagick - Memory Leak in TXT File Processing via Texture Attribute (CVSS 6.9, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-48109](https://cve.now/CVE-2026-48109.md): MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input (CVSS 8.2, MessagePack-CSharp · MessagePack)
- [CVE-2026-48502](https://cve.now/CVE-2026-48502.md): MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows (CVSS 8.2, MessagePack-CSharp · MessagePack)
- [CVE-2026-48506](https://cve.now/CVE-2026-48506.md): MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth (CVSS 7.5, MessagePack-CSharp · MessagePack)
- [CVE-2026-48509](https://cve.now/CVE-2026-48509.md): MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48510](https://cve.now/CVE-2026-48510.md): MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48511](https://cve.now/CVE-2026-48511.md): MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48512](https://cve.now/CVE-2026-48512.md): MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48513](https://cve.now/CVE-2026-48513.md): MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48514](https://cve.now/CVE-2026-48514.md): MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48515](https://cve.now/CVE-2026-48515.md): MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48516](https://cve.now/CVE-2026-48516.md): MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-48517](https://cve.now/CVE-2026-48517.md): MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments (CVSS 6.3, MessagePack-CSharp · MessagePack)
- [CVE-2026-40372](https://cve.now/CVE-2026-40372.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 9.1, Microsoft ASP.NET Core · Microsoft Visual Studio +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/ecosystem/nuget
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.