NuGetPackage

CoreWCF.Primitives

8 known vulnerabilities (1 critical, 4 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 1.9.1 (Jun 16, 2026): no advisory affects it
Newest unaffected release: 1.9.1 (Jun 16, 2026), the latest release
Advisories: 8 · 1 critical, 4 high, 2 medium, 1 low

Releases: 38 since 0.1.0 (Feb 19, 2021)
Registry: NuGet
Releases read: Nov 8, 2026

Version timeline

CVE-2026-54782
Affects 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
CVE-2026-54781
Affects 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
CVE-2026-54784
Affects 1.9.0 (1.9.1 is outside it)
CVE-2026-54774
Affects 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
CVE-2026-54783
Affects 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
CVE-2026-54780
Affects 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
CVE-2026-54773
Affects 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)
CVE-2026-54779
Affects 0.1.0-alpha.209 to 1.8.0 (1.8.1 is outside it); 1.9.0 (1.9.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-54782Critical 10.0
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.
CVE-2026-54781High 7.4
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.
CVE-2026-54784High 7.4
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Affected: from 1.9.0, fixed in 1.9.1.
Fixed in 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.
CVE-2026-54774High 7.4
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.
CVE-2026-54783High 7.4
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.
CVE-2026-54780Low 3.7
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.
CVE-2026-54773Medium 5.9
CoreWCF: WS-Security signature substitution via document-wide Signature lookup
Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.
CVE-2026-54779Medium 5.9
CoreWCF: SAML token replay protection is inoperative
Affected: fixed in 1.8.1; from 1.9.0, fixed in 1.9.1.
Fixed in 1.8.1 (released Jun 16, 2026, 22 days before disclosure) and 1.9.1 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 1.9.1, is not affected.