CVE-2026-32177

CVE-2026-32177 is a heap-based buffer overflow in the .NET Framework that enables local privilege escalation. The issue is described across multiple sources as affecting the .NET Framework components in versions 3.5 and 4.8.1, with impact described as unauthorized elevation of privileges locally ...

CVE-2026-45591

CVE-2026-45591 is an ASP.NET Core Denial of Service vulnerability caused by uncontrolled resource consumption, enabling network-based DoS by an unauthorized attacker. The NVD entries describe the impact as availability loss with a CVSS v3.1 base score of 7.5 (NETWORK, HIGH) and no confidentiality...

CVE-2026-47302

CVE-2026-47302 describes a Denial of Service in .NET caused by allocation of resources without limits or throttling, enabling a network-based attack. Affected: .NET stack (resource allocation path) as described in the CVE entry. Impact: unauthorized denial of service over a network; CVSS 3.1 base...

CVE-2026-62897

CVE-2026-62897 affects the .NET Framework due to an integer overflow/wraparound in a component, allowing a locally authenticated attacker to execute code. Root cause: integer overflow vulnerability; impact: local code execution with high confidentiality, integrity, and availability impacts per CV...

CVE-2026-47300

The vulnerability CVE-2026-47300 affects ASP.NET Core and is due to an incorrect implementation of the authentication algorithm that could allow an authorized attacker to elevate privileges over a network. The CVSS v3.1 base score is 8.8 (HIGH) with NETWORK attack vector, LOW attack complexity, a...

CVE-2026-47304

The CVE-2026-47304 entry concerns a vulnerability in .NET (System.Security.Cryptography.Xml) where the XML Encryption (EncryptedXml) implementation has an improper verification of cryptographic signatures. The issue affects multiple .NET package lines (notably .NET 8.x, 9.x and 10.x) with affecte...

CVE-2026-70354

CVE-2026-70354 is an out-of-bounds write vulnerability in .NET that could allow an attacker to execute code locally on a vulnerable host. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL exploit, no user interaction required? Actually user interaction is required per metrics. The vulnerability is...

CVE-2026-62886

CVE-2026-62886: integer overflow/wraparound in .NET allows local privilege escalation; affected component is .NET. Root cause: integer overflow. Exploitation details and fixes are not provided in the attached documents; consult the Microsoft update guide for remediation if available.

CVE-2026-62900

CVE-2026-62900 concerns a .NET information disclosure vulnerability caused by improper removal of sensitive information before storage or transfer. The issue enables an attacker to disclose data over a network (CVSS v3.1: 5.9 MEDIUM; Network, High attack complexity, No privileges required, No use...

CVE-2026-62901

The CVE-2026-62901 entry describes a denial-of-service (DoS) vulnerability in .NET due to unchecked input for a loop condition, enabling an unauthenticated network attacker to cause service disruption. The available data notes network access, low attack complexity, and no privileges or user inter...

CVE-2026-32175

The CVE-2026-32175 entry describes a tampering vulnerability in .NET Core where specially crafted files could cause writing of arbitrary files/directories to certain locations. The exploitation requires sending a crafted file to a vulnerable system, and the attacker would have limited control ove...

CVE-2026-50525

CVE-2026-50525 is a .NET Denial of Service vulnerability described as allocation of resources without limits/throttling that can allow an unauthenticated attacker to cause network-based service disruption. Connected sources confirm impact on Microsoft components including .NET and related Develop...

CVE-2026-62871

The CVE-2026-62871 entry describes an out-of-bounds write in .NET that could allow an unauthorized attacker to execute code locally. Documented impact is high (C:H/I:H/A:H) with local attack vector and required user interaction. The provided sources do not specify affected versions, root cause be...

CVE-2026-62899

CVE-2026-62899 involves inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in .NET, allowing an unauthenticated attacker to bypass a security feature over a network. The vulnerability affects .NET components handling HTTP semantics and could allow bypassing safeguards ...

CVE-2026-50524

CVE-2026-50524 is a .NET Framework Denial of Service vulnerability caused by improper validation of a specified input type. The issue can allow an unauthenticated attacker to disrupt service over a network without requiring user interaction; impact is described as a network-based DoS with high se...

CVE-2026-50649

CVE-2026-50649 is a .NET/CLR deserialization vulnerability that allows a local attacker to execute arbitrary code by feeding untrusted data. Affected: .NET/NET Core components; root cause is insecure deserialization. Impact per NCSC: execution of arbitrary code with high severity. Exploitation re...

CVE-2026-62898

CVE-2026-62898 describes a use-after-free in Microsoft QUIC that enables an unauthenticated attacker to disclose information over the network. The connected documents confirm the vulnerability type and impact (information disclosure) but do not provide affected versions, impacted components beyon...

CVE-2026-69805

CVE-2026-69805 is an elevation of privilege vulnerability in Microsoft .NET , caused by external control of a file name or path . An unauthorized network-based attacker can exploit this to escalate privileges, with high impact on confidentiality, integrity, and availability. The CVSS 3.1 score is...

CVE-2026-50648

CVE-2026-50648 describes a denial-of-service in .NET Framework caused by allocation of resources without limits or throttling. The CVE is network-exploitable (attack vector: network, privileges: none, user interaction: none) with an attacker able to exhaust resources and disrupt service. The NVD ...

CVE-2026-69806

CVE-2026-69806 is a .NET Elevation of Privilege vulnerability caused by exposure of sensitive information to an unauthorized actor, which an authorized local attacker can exploit to escalate privileges. The CVSS 3.1 score is 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicat...

CVE-2026-50646

CVE-2026-50646 affects the .NET Framework. The vulnerability is a protection mechanism failure that could allow an unauthenticated local attacker to execute code on the affected system (attack vector: LOCAL; privileges required: NONE; user interaction required). The CVSS 3.1 base score is 7.8 (HI...

CVE-2026-50528

CVE-2026-50528 is a .NET security feature bypass vulnerability (Incorrect authorization) that enables a network attacker to bypass a security feature. The NCSC advisory and MITRE listing in the CVE community indicate it is categorized as a bypass of security measures with an 8.2–8.20 base score i...

CVE-2026-58649

CVE-2026-58649 is an origin validation error in .NET that allows an unauthorized, remote attacker to disclose information over a network . The vulnerability requires user interaction (UI:R) but no prior privileges (PR:N). CVSS 3.1 scores it 6.5 (MEDIUM) with high confidentiality impact and no int...

CVE-2026-69439

A heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network, as reported by Microsoft (CNA: [email protected]). The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicati...

CVE-2026-62902

CVE-2026-62902 concerns a .NET information-disclosure issue arising from inclusion of functionality from an untrusted control sphere. The vulnerability allows an unauthenticated attacker to disclose information over a network, with an attack vector over the network, required user interaction, and...

CVE-2026-50527

CVE-2026-50527 is a stack-based buffer overflow in the .NET Framework that can allow an unauthenticated, network-based attacker to cause denial of service. The vulnerability affects the .NET Framework components handling network input; exploitation leads to an out-of-bounds write with service dis...

CVE-2026-47303

CVE-2026-47303 affects ASP.NET Core. Authentication bypass by assumed-immutable data enables an authorized attacker to elevate privileges over a network. From the provided metrics, the CVSS v3.1 base score is 8.8 (HIGH) with Network attack vector, Low attack complexity, Privileges Required: LOW, ...

CVE-2026-50659

CVE-2026-50659 is a .NET spoofing vulnerability caused by improper encoding/escaping of output, enabling an authorized attacker to perform network spoofing. Affected: .NET across multiple updates; exploitation status is not detailed in the provided documents. Remediation: Microsoft has released u...

CVE-2026-32203

CVE-2026-32203 is listed in the connected Nessus advisories as a Denial of Service via stack overflow affecting .NET components across multiple Linux distributions. The provided documents do not specify exact affected versions, vulnerable component details, exploit methods, or remediation steps.

CVE-2026-69304

CVE-2026-69304 is a Denial of Service (DoS) vulnerability in ASP.NET Core caused by improper handling of highly compressed data, also referred to as data amplification . An unauthorized attacker over a network can trigger a denial of service without requiring prior authentication or user interact...

CVE-2026-62909

The CVE-2026-62909 entry concerns an uncaught exception in .NET that allows an authorized attacker to locally elevate privileges. Affected software is the .NET framework/component referenced in the CVE description. The impact is elevation of privilege with a high base score (CVSS 3.1: 7.8, HIGH),...

CVE-2026-50651

CVE-2026-50651 is a .NET Denial of Service vulnerability associated with an HTTP/2 SETTINGS/PING ACK flood that can lead to out-of-memory conditions. Public descriptions identify the impact as denial of service over a network, with a CVSS v3.1 base score of 7.5 (Network, Low attack complexity, No...

CVE-2026-50526

CVE-2026-50526 describes an issue in .NET where improper link resolution before file access ("link following") can allow an authorized local attacker to tamper with files. Multiple sources document the same description and note a local attack vector with high impact on confidentiality, integrity,...

CVE-2026-71328

A heap-based buffer overflow in Visual Studio (and .NET , per the CVE record) allows an unauthorized attacker to execute code over a network, constituting a Remote Code Execution (RCE) vulnerability. The CVSS v3.1 base score is 8.8 (HIGH) , with the attack requiring user interaction but no prior ...

CVE-2026-47305

Technical details such as affected products, component versions, root cause, and mitigation are not publicly available in the provided documents. Monitor for updates from MSRC and NCSC advisories.

CVE-2026-88092

A critical HTTP request/response smuggling vulnerability exists in ASP.NET Core due to the inconsistent interpretation of HTTP requests. An unauthorized attacker can exploit this flaw to perform tampering over a network. This vulnerability has a CVSS 3.1 base score of 9.4 , indicating a high impa...

CVE-2026-96222

A vulnerability in Active Directory Federation Services (AD FS) stems from improper certificate validation . This flaw allows an unauthorized attacker to perform spoofing over a network. The vulnerability has a base severity of 7.4 (High) according to the CVSS 3.1 metric provided. No specific exp...

CVE-2026-77906

CVE-2026-77906 is a heap-based buffer overflow in Visual Studio that allows an unauthorized attacker to achieve remote code execution over a network. The vulnerability requires user interaction but no prior privileges (CVSS 3.1: 8.8 HIGH , AV:N/AC:L/PR:N/UI:R). Successful exploitation can lead to...

CVE-2026-85790

A Use after free vulnerability in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. The vulnerability is characterized by a high confidentiality impact, though it does not affect integrity or availability. Remediation is available via an official fix provided ...

CVE-2026-96957

The .NET framework is affected by a vulnerability where improper verification of cryptographic signatures allows an unauthorized attacker to bypass a security feature over a network. This flaw can result in skipping security measures with a CVSS 3.1 score of 8.8. Remediation information is not ex...

CVE-2026-77907

A heap-based buffer overflow in Visual Studio allows an unauthorized attacker to achieve remote code execution over a network. The CVSS v3.1 score is 8.8 (High) , with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning user interaction is required but no prior privileges are needed. CISA's ...