.net (Microsoft) - vulnerabilities (CVEs)

196 CVEs, 36 in the last 30 days, 220 known versions, newest CVE from 2026-10-22. Vendor: Microsoft.

CVEs of .net

• CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
• CVE-2026-97801 - CVSS 7.5 (high), 2026-10-13: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
• CVE-2026-105016 - CVSS 9.8 (critical), 2026-10-13: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
• CVE-2026-102869 - CVSS 8.8 (high), 2026-10-13: Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-58280 - CVSS 7.5 (high), 2026-10-13: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-97788 - CVSS 7.5 (high), 2026-10-13: Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96959 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96958 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96957 - CVSS 8.8 (high), 2026-10-13: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-96960 - CVSS 7.5 (high), 2026-10-13: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96238 - CVSS 6.5 (medium), 2026-10-13: Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-96229 - CVSS 6.5 (medium), 2026-10-13: Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96233 - CVSS 7.5 (high), 2026-10-13: Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-96237 - CVSS 7.5 (high), 2026-10-13: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-96225 - CVSS 7.8 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-96232 - CVSS 7.5 (high), 2026-10-13: Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96235 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-96231 - CVSS 7.8 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-96234 - CVSS 5.3 (medium), 2026-10-13: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-84008 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-83520 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-70035 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
• CVE-2026-85363 - CVSS 8.8 (high), 2026-10-13: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-70007 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
• CVE-2026-96222 - CVSS 7.4 (high), 2026-10-13: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-96224 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-70194 - CVSS 6.5 (medium), 2026-10-13: Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-70161 - CVSS 7.3 (high), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-70190 - CVSS 7.3 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-70197 - CVSS 8.1 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-70165 - CVSS 6.7 (medium), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-70174 - CVSS 8.8 (high), 2026-10-13: Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-87697 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-69651 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-66822 - CVSS 5.9 (medium), 2026-10-13: Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-108398 - CVSS 8.8 (high), 2026-10-13: Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
• CVE-2026-69806 - CVSS 7 (high), 2026-09-08: Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-71328 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
• CVE-2026-69304 - CVSS 5.9 (medium), 2026-09-08: Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-58649 - CVSS 6.5 (medium), 2026-09-08: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-69439 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-69522 - CVSS 8.8 (high), 2026-09-08: Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
• CVE-2026-62898 - CVSS 7.5 (high), 2026-08-11: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
• CVE-2026-70354 - CVSS 7.8 (high), 2026-08-11: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
• CVE-2026-65810 - CVSS 7.8 (high), 2026-08-11: Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-62886 - CVSS 7.8 (high), 2026-08-11: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-62872 - CVSS 8.8 (high), 2026-08-11: Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
• CVE-2026-62871 - CVSS 7.8 (high), 2026-08-11: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
• CVE-2026-58641 - CVSS 7.8 (high), 2026-08-11: Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-62909 - CVSS 7.8 (high), 2026-08-11: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-62902 - CVSS 6.5 (medium), 2026-08-11: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-62901 - CVSS 7.5 (high), 2026-08-11: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-62900 - CVSS 5.9 (medium), 2026-08-11: Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-62899 - CVSS 5.9 (medium), 2026-08-11: Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a…
• CVE-2026-62897 - CVSS 7 (high), 2026-08-11: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
• CVE-2026-50659 - CVSS 6.5 (medium), 2026-07-14: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
• CVE-2026-50651 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-50650 - CVSS 7.8 (high), 2026-07-14: Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-50649 - CVSS 7.8 (high), 2026-07-14: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
• CVE-2026-50648 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
• CVE-2026-50646 - CVSS 7.8 (high), 2026-07-14: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
• CVE-2026-50528 - CVSS 8.2 (high), 2026-07-14: Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-50527 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
• CVE-2026-50526 - CVSS 7 (high), 2026-07-14: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
• CVE-2026-50525 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-50524 - CVSS 7.5 (high), 2026-07-14: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
• CVE-2026-47304 - CVSS 9.8 (critical), 2026-07-14: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-47303 - CVSS 8.8 (high), 2026-07-14: Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
• CVE-2026-47302 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-47300 - CVSS 8.8 (high), 2026-07-14: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
• CVE-2026-57108 - CVSS 7.5 (high), 2026-07-14: Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-50647 - CVSS 7.5 (high), 2026-07-14: Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a…
• CVE-2026-50411 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
• CVE-2026-50355 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
• CVE-2026-50324 - CVSS 5.9 (medium), 2026-07-14: Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a…
• CVE-2026-50368 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
• CVE-2026-50304 - CVSS 7.5 (high), 2026-07-14: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
• CVE-2026-50653 - CVSS 7.5 (high), 2026-07-14: Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
• CVE-2026-50652 - CVSS 7.5 (high), 2026-07-14: Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
• CVE-2026-56170 - CVSS 7.5 (high), 2026-07-14: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-45591 - CVSS 7.5 (high), 2026-06-09: Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-45491 - CVSS 6.2 (medium), 2026-06-09: Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
• CVE-2026-45490 - CVSS 7.8 (high), 2026-06-09: Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-42899 - CVSS 7.5 (high), 2026-05-12: Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-35433 - CVSS 7.3 (high), 2026-05-12: Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-32177 - CVSS 7.3 (high), 2026-05-12: Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-32175 - CVSS 4.3 (medium), 2026-05-12: A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could…
• CVE-2026-33116 - CVSS 7.5 (high), 2026-04-14: Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
• CVE-2026-32226 - CVSS 5.9 (medium), 2026-04-14: Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service…
• CVE-2026-32203 - CVSS 7.5 (high), 2026-04-14: Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
• CVE-2026-32178 - CVSS 7.5 (high), 2026-04-14: Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-26171 - CVSS 7.5 (high), 2026-04-14: Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-23666 - CVSS 7.5 (high), 2026-04-14: Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
• CVE-2026-25667 - CVSS 7.5 (high), 2026-03-19: ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a…
• CVE-2026-26131 - CVSS 7.8 (high), 2026-03-10: Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2026-26127 - CVSS 7.5 (high), 2026-03-10: Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-21218 - CVSS 7.5 (high), 2026-02-10: Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-55248 - CVSS 5.7 (medium), 2025-10-14: Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
• CVE-2025-55247 - CVSS 7.3 (high), 2025-10-14: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
• CVE-2025-30399 - CVSS 7.5 (high), 2025-06-13: Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.