Ecosystem

NuGet

1,175 known vulnerabilities.

Most affected packages

Microsoft.ChakraCore 247 magick.net-q16-anycpu 165 magick.net-q16-hdri-anycpu 165 magick.net-q8-anycpu 165 Magick.NET-Q16-HDRI-x86 163 Magick.NET-Q16-x86 162 Magick.NET-Q8-x86 162 Magick.NET-Q16-HDRI-x64 160 Magick.NET-Q16-OpenMP-x64 160 Magick.NET-Q16-arm64 160 Magick.NET-Q16-OpenMP-arm64 160 Magick.NET-Q16-HDRI-OpenMP-arm64 160 Magick.NET-Q8-arm64 159 Magick.NET-Q8-OpenMP-arm64 159 Magick.NET-Q16-HDRI-arm64 159 magick.net-q8-openmp-x64 157 magick.net-q16-x64 156 magick.net-q8-x64 154 Magick.NET-Q16-HDRI-OpenMP-x64 95 Magick.NET-Q16-OpenMP-x86 68 Microsoft.NETCore.App.Runtime.win-x64 52 Microsoft.NETCore.App.Runtime.win-arm64 51 Microsoft.NETCore.App.Runtime.win-x86 51 Microsoft.AspNetCore.App.Runtime.win-x64 47 Microsoft.AspNetCore.App.Runtime.win-x86 46 Microsoft.NETCore.App.Runtime.linux-x64 44 Microsoft.NETCore.App.Runtime.linux-arm 43 Microsoft.NETCore.App.Runtime.linux-arm64 43 Microsoft.NETCore.App.Runtime.linux-musl-arm64 43 Microsoft.NETCore.App.Runtime.linux-musl-x64 43 Microsoft.AspNetCore.App.Runtime.win-arm64 43 Microsoft.AspNetCore.App.Runtime.linux-x64 42 Microsoft.NETCore.App.Runtime.osx-x64 41 Microsoft.AspNetCore.App.Runtime.linux-arm 41 Microsoft.AspNetCore.App.Runtime.linux-arm64 41 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 41 Microsoft.AspNetCore.App.Runtime.osx-x64 41 Microsoft.NETCore.App.Runtime.linux-musl-arm 41 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 40 Microsoft.AspNetCore.App.Runtime.linux-musl-arm 36

All Critical High Medium Low Exploited only Public exploit

1,175 results · Feed

Low 2.1

CVE-2021-22143

Elastic APM .NET Agent information disclosure

The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an applica…

Elastic Elastic APM .NET Agent Elastic.Apm NuGet

Nov 22, 2023
Medium 6.1

CVE-2023-48219

Special characters in unescaped text nodes can trigger mXSS in TinyMCE

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not escaped upon serialization accordi…

tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet

Nov 15, 2023
Medium 6.2

CVE-2023-36558

ASP.NET Core Security Feature Bypass Vulnerability

ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Nov 14, 2023
High 7.6

CVE-2023-36049

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Nov 14, 2023
Medium 6.1

CVE-2023-45818

Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave plugin

TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a stri…

tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet

Oct 19, 2023
Medium 6.1

CVE-2023-45819

Cross-site Scripting vulnerability in TinyMCE notificationManager.open API

TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions f…

tinymce tinymce tinymce tinymce Ubuntu npm Packagist NuGet

Oct 19, 2023
Medium 5.3

CVE-2023-45814

Tokens cached in the AuthenticationService are susceptible to reuse in Bunkum

Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's `AuthenticationService` only supported injecting `IUser`s. However, as Refresh and SoundShapesServer implement…

LittleBigRefresh Bunkum Bunkum NuGet

Oct 18, 2023
High 8.8

CVE-2023-36414

Azure Identity SDK Remote Code Execution Vulnerability

Azure Identity SDK Remote Code Execution Vulnerability

Microsoft Azure Identity SDK for .NET Azure.Identity NuGet

Oct 10, 2023
Medium 6.5

CVE-2023-36566

Microsoft Common Data Model SDK Denial of Service Vulnerability

Microsoft Common Data Model SDK Denial of Service Vulnerability

Microsoft Microsoft Common Data Model SDK for Java Microsoft Common Data Model SDK for Python Microsoft Common Data Model SDK for TypeScript Maven PyPI NuGet

Oct 10, 2023
High 7.5

CVE-2023-36435

Microsoft QUIC Denial of Service Vulnerability

Microsoft QUIC Denial of Service Vulnerability

Microsoft Windows Server 2022 Windows 11 version 22H2 Windows 11 version 21H2 Windows Alpine NuGet

Oct 10, 2023
High 7.5

CVE-2023-38171 EPSS 71%

Microsoft QUIC Denial of Service Vulnerability

Microsoft QUIC Denial of Service Vulnerability

Microsoft Windows Server 2022 Windows 11 version 22H2 Windows 11 version 21H2 Windows Alpine NuGet

Oct 10, 2023
High 8.8

GHSA-wqcr-xm43-hpqr

Vulnerable version of libwebp and can be exploited with a malicious source image

### Impact This vulnerability affects deployments of FreeImage that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you, but **you should remove FreeImage from your project, as it…

ImageResizer.Plugins.FreeImage NuGet

Oct 6, 2023
Medium 6.1

CVE-2023-44390

HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either `svg` or `math` are in the list of allowed element…

mganss HtmlSanitizer HtmlSanitizer NuGet

Oct 5, 2023
High —

GHSA-4c29-gfrp-g6x9

CefSharp affected by libvpx's heap buffer overflow in vp8 encoding

Google is aware that an exploit for CVE-2023-5217 exists in the wild. Description Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a …

CefSharp.Common CefSharp.Common.NETCore NuGet

Oct 5, 2023
High 8.8

GHSA-7vpr-3ppw-qrpj

Imageflow affected by libwebp zero-day and should not be used with malicious source images.

### Impact This vulnerability affects deployments of Imageflow that involve decoding or processing malicious source .webp files. If you only process your own trusted files, this should not affect you (but you should update anyway). Imageflow relies on Google'…

Imageflow.NativeRuntime.ubuntu_16_04-x86_64 Imageflow.NativeTool.osx-x86_64 Imageflow.NativeTool.ubuntu_16_04-x86_64 Imageflow.AllPlatforms NuGet

Sep 27, 2023
Critical —

GHSA-j646-gj5p-p45g

CefSharp affected by heap buffer overflow in WebP

**Google is aware that an exploit for [CVE-2023-4863](https://www.cve.org/CVERecord?id=CVE-2023-4863) exists in the wild.** ### Description Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bo…

CefSharp.Common CefSharp.Common.NETCore NuGet

Sep 21, 2023
High 7.5

CVE-2023-41890

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. Th…

Sustainsys Saml2 Sustainsys.Saml2 Kentor.AuthServices NuGet

Sep 19, 2023
High 7.8

CVE-2023-36792

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36793

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36796

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36794

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Sep 12, 2023
Medium 6.5

CVE-2023-36799

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Sep 12, 2023
High 8.8

CVE-2023-4863 Exploited Public exploit EPSS 100%

libwebp: OOB write in BuildHuffmanTable

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Google Chrome libwebp chromium Browsers Debian Ubuntu Azure Linux Alpine Wolfi npm PyPI Go crates.io NuGet

Sep 12, 2023
KEV Sep 13, 2023
Low —

GHSA-6r78-m64m-qwcf

Moq v4.20.0-rc to 4.20.1 share hashed user data

Moq v4.20.0-rc to 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. T…

moq NuGet

Aug 10, 2023
High 7.5

CVE-2023-38180 Exploited EPSS 14%

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Aug 8, 2023
KEV Aug 9, 2023
Medium 6.2

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Aug 8, 2023
High 7.5

CVE-2023-38178

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 .NET 6.0 Ubuntu Alpine NuGet

Aug 8, 2023
High 7.8

CVE-2023-35390

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Aug 8, 2023
High 7.5

CVE-2023-37267

Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions

Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.

umbraco Umbraco-CMS Umbraco.Cms.Web.BackOffice Umbraco.Cms.Infrastructure NuGet

Jul 13, 2023
High 8.1

CVE-2023-33170

ASP.NET and Visual Studio Security Feature Bypass Vulnerability

ASP.NET and Visual Studio Security Feature Bypass Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Jul 11, 2023
High 8.1

CVE-2023-33127

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Jul 11, 2023
High 7.5

CVE-2023-33141

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability

Microsoft YARP 1.0 YARP 2.0 Yarp.ReverseProxy NuGet

Jun 23, 2023
Critical 9.8

CVE-2023-32571 Public exploit EPSS 35%

Dynamic Linq vulnerable to remote code execution

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

System.Linq.Dynamic.Core NuGet

Jun 22, 2023
High 7.1

CVE-2023-29337

NuGet Client Remote Code Execution Vulnerability

NuGet Client Remote Code Execution Vulnerability

Microsoft NuGet 6.3.2 NuGet 6.6.0 NuGet 6.2.3 Debian Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-29331

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-24936

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-24895

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-24897

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Jun 14, 2023
High 7.3

CVE-2023-33128

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Jun 13, 2023
High 7.3

CVE-2023-33126

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Jun 13, 2023