vulnerabilities handled in Microsoft Developer Tools

Microsoft has identified vulnerabilities in various Developer Tools. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage, as listed in the table below. For successful exploitation, the malicious individual must deceive victims into importing and...

Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET diagnostics IPC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A missing error check in .NET causes an...

CVE-2026-62899

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-70354 .NET Core Remote Code Execution Vulnerability

...

CVE-2026-62886 .NET Elevation of Privilege Vulnerability

...

EUVD-2026-56680

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network...

EUVD-2026-56412

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-62909

The CVE-2026-62909 entry concerns an uncaught exception in .NET that allows an authorized attacker to locally elevate privileges. Affected software is the .NET framework/component referenced in the CVE description. The impact is elevation of privilege with a high base score (CVSS 3.1: 7.8, HIGH),...

EUVD-2026-56410

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network...

EUVD-2026-56409

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-62901

The CVE-2026-62901 entry describes a denial-of-service (DoS) vulnerability in .NET due to unchecked input for a loop condition, enabling an unauthenticated network attacker to cause service disruption. The available data notes network access, low attack complexity, and no privileges or user inter...

2026-08 .NET 10.0.11 Security Update for x64 Server (KB5122106)

2026-08 .NET 10.0.11 Security Update for x64 Server KB5122106...

2026-08 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2 for x64 (KB5121646)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

.NET 10.0 Update - August 11, 2026

None None...

Photon OS 5.0: Dotnet PHSA-2025-5.0-91-0499

An update of the dotnet package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0499. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Malicious code in bigops-status-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...

Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

MAL-2026-13318 Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

MAL-2026-12847 Malicious code in bigops-tinkoff-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cb54c5f503b1cad2b4ae932f592d8870df743b1c1b6b029616343b65f6ae09 On require of the package, index.js loads runtime.js which fetches a platform-specific binary from Cloudflare Workers hosts...

MAL-2026-12861 Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...