Security Digest
Critical NuGet advisories
32 critical advisories for NuGet packages since October 2023, newest first. Check your project with dotnet list package --vulnerable --include-transitive.
- Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability CVE-2026-88092 CVSS 9.4 Critical
Microsoft.AspNetCore.App.Runtime.linux-arm>= 8.0.0, <= 8.0.31 → fixed in 8.0.32;Microsoft.AspNetCore.App.Runtime.linux-arm64>= 8.0.0, <= 8.0.31 → fixed in 8.0.32;Microsoft.AspNetCore.App.Runtime.linux-musl-arm>= 8.0.0, <= 8.0.31 → fixed in 8.0.32; +41 more packages - Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability CVE-2026-70188 CVSS 9.1 Critical
Microsoft.AspNetCore.App.Runtime.linux-arm>= 11.0.0-preview.1, <= 11.0.0-rc.1 → fixed in 11.0.0-rc.2;Microsoft.AspNetCore.App.Runtime.linux-arm64>= 11.0.0-preview.1, <= 11.0.0-rc.1 → fixed in 11.0.0-rc.2;Microsoft.AspNetCore.App.Runtime.linux-musl-arm>= 11.0.0-preview.1, <= 11.0.0-rc.1 → fixed in 11.0.0-rc.2; +41 more packages - Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability CVE-2026-105016 CVSS 9.8 Critical
Microsoft.Native.Quic.MsQuic.Schannel= 2.5.11-ci.156755675 → fixed in 2.5.11-ci.159417053 - MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL CVE-2026-105794 CVSS 9.1 Critical
Microsoft.Native.Quic.MsQuic.OpenSSL< 2.4.20 → fixed in 2.4.20;Microsoft.Native.Quic.MsQuic.OpenSSL>= 2.5.0, < 2.5.11 → fixed in 2.5.11;Microsoft.Native.Quic.MsQuic.OpenSSL>= 2.6.0, < 2.6.1 → fixed in 2.6.1 - Marten's LINQ provider has SQL injection via unescaped string literals CVE-2026-75513 CVSS 9.1 Critical
Marten>= 7.0.0, <= 9.12.0 → fixed in 9.13.0 - Microsoft QUIC: Remote Code Execution Vulnerability CVE-2026-62815 CVSS 10.0 Critical
Microsoft.Native.Quic.MsQuic.OpenSSL>= 2.5.3, < 2.5.10 → fixed in 2.5.10;Microsoft.Native.Quic.MsQuic.Schannel>= 2.5.3, < 2.5.10 → fixed in 2.5.10;Microsoft.Native.Quic.MsQuic.OpenSSL< 2.4.19 → fixed in 2.4.19; +1 more packages - Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` CVE-2026-59865 CVSS 9.3 Critical
Microsoft.OpenApi.Kiota>= 1.30.0, < 1.32.5 → fixed in 1.32.5;Microsoft.OpenApi.Kiota.Builder>= 1.30.0, < 1.32.5 → fixed in 1.32.5;Microsoft.OpenApi.Kiota< 1.29.1 → fixed in 1.29.1; +1 more packages - Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions CVE-2026-59864 CVSS 9.3 Critical
Microsoft.OpenApi.Kiota>= 1.30.0, < 1.32.5 → fixed in 1.32.5;Microsoft.OpenApi.Kiota.Builder>= 1.30.0, < 1.32.5 → fixed in 1.32.5;Microsoft.OpenApi.Kiota< 1.29.1 → fixed in 1.29.1; +1 more packages - CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation CVE-2026-54782 CVSS 10.0 Critical
CoreWCF.Primitives< 1.8.1 → fixed in 1.8.1;CoreWCF.Primitives>= 1.9.0, < 1.9.1 → fixed in 1.9.1 - DotVVM: Missing authorization in AuthorizeActionFilter GHSA-c8qj-jx8j-fg2w CVSS 9.2 Critical
DotVVM< 4.2.11 → fixed in 4.2.11;DotVVM> 4.3.0-preview01-final, < 4.3.15 → fixed in 4.3.15;DotVVM>= 5.0.0-preview01-final, < 5.0.0-preview09-final → fixed in 5.0.0-preview09-final - Marten has an injection vulnerability in its full-text search regConfig parameter CVE-2026-45288 CVSS 9.8 Critical
Marten<= 8.36 → fixed in 8.37.0 - Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege CVE-2026-40372 CVSS 9.1 Critical
Microsoft.AspNetCore.DataProtection>= 10.0.0, <= 10.0.6 → fixed in 10.0.7 - ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents CVE-2026-40324 CVSS 9.1 Critical
HotChocolate.Language< 12.22.7 → fixed in 12.22.7;HotChocolate.Language>= 13.0.0, < 13.9.16 → fixed in 13.9.16;HotChocolate.Language>= 14.0.0, < 14.3.1 → fixed in 14.3.1; +1 more packages - MsQuic has a Remote Elevation of Privilege Vulnerability CVE-2026-32179 CVSS 9.8 Critical
Microsoft.Native.Quic.MsQuic.OpenSSL>= 2.5.0-ci.532574, < 2.5.7 → fixed in 2.5.7;Microsoft.Native.Quic.MsQuic.Schannel>= 2.5.0-ci.532574, < 2.5.7 → fixed in 2.5.7;Microsoft.Native.Quic.MsQuic.Schannel< 2.4.18 → fixed in 2.4.18; +1 more packages - Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse GHSA-5wr9-m6jw-xx44 CVSS 9.1 Critical
scriban< 7.0.0 → fixed in 7.0.0;Scriban.Signed< 7.0.0 → fixed in 7.0.0 - Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK CVE-2026-25592 CVSS 9.9 Critical
semantic-kernel< 1.39.3 → fixed in 1.39.3;Microsoft.SemanticKernel.Core< 1.71.0 → fixed in 1.71.0 - DotNetNuke.Core Vulnerable to Stored XSS via Module Title CVE-2026-24838 CVSS 9.1 Critical
DotNetNuke.Core< 9.13.10 → fixed in 9.13.10;DotNetNuke.Core>= 10.0.0, < 10.2.0 → fixed in 10.2.0 - UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation CVE-2025-68924 CVSS 9.9 Critical
UmbracoForms<= 8.13.16 → no fix listed - DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite CVE-2025-64095 CVSS 10.0 Critical
DNN.PLATFORM< 10.1.1 → fixed in 10.1.1 - Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability CVE-2025-54539 CVSS 9.8 Critical
Apache.NMS.AMQP< 2.4.0 → fixed in 2.4.0 - Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability CVE-2025-55315 CVSS 9.9 Critical
Microsoft.AspNetCore.App.Runtime.linux-arm= 10.0.0-rc.1.25451.107 → fixed in 10.0.0-rc.2.25502.107;Microsoft.AspNetCore.App.Runtime.linux-arm64= 10.0.0-rc.1.25451.107 → fixed in 10.0.0-rc.2.25502.107;Microsoft.AspNetCore.App.Runtime.linux-musl-arm= 10.0.0-rc.1.25451.107 → fixed in 10.0.0-rc.2.25502.107; +34 more packages - Akka.Remote TLS did not properly implement certificate-based authentication CVE-2025-61778 CVSS 9.3 Critical
Akka.Remote>= 1.2.0, < 1.5.52 → fixed in 1.5.52;Akka.Cluster>= 1.2.0, < 1.5.52 → fixed in 1.5.52 - DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module CVE-2025-59545 CVSS 9.0 Critical
DotNetNuke.Core< 10.1.0 → fixed in 10.1.0 - YoutubeDLSharp allows command injection on windows system due to non sanitized arguments CVE-2025-43858 CVSS 9.2 Critical
YoutubeDLSharp>= 1.0.0-beta4, < 1.1.2 → fixed in 1.1.2 - Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability CVE-2025-29953 CVSS 9.8 Critical
Apache.NMS.ActiveMQ< 2.1.1 → fixed in 2.1.1 - AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass CVE-2025-24895 CVSS 9.1 Critical
CIE.AspNetCore.Authentication<= 2.0.4 → fixed in 2.1.0 - The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass CVE-2025-24894 CVSS 9.1 Critical
SPID.AspNetCore.Authentication<= 3.3.0 → fixed in 3.4.0 - .NET Remote Code Execution Vulnerability CVE-2024-43498 CVSS 9.2 Critical
System.Formats.Nrbf< 9.0.0 → fixed in 9.0.0 - CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes CVE-2024-51501 CVSS 10.0 Critical
Refit< 7.2.22 → fixed in 7.2.22 - CLSA Directory Traversal vulnerability CVE-2024-28698 CVSS 9.3 Critical
Csla< 5.5.4 → fixed in 5.5.4;Csla>= 6.0.0, <= 6.2.2 → fixed in 8.0.0;Csla>= 7.0.0, <= 7.0.5 → fixed in 8.0.0 - Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability CVE-2024-35264 CVSS 9.2 Critical
Microsoft.AspNetCore.App.Runtime.linux-arm>= 8.0.0, <= 8.0.6 → fixed in 8.0.7;Microsoft.AspNetCore.App.Runtime.linux-arm64>= 8.0.0, <= 8.0.6 → fixed in 8.0.7;Microsoft.AspNetCore.App.Runtime.linux-musl-arm>= 8.0.0, <= 8.0.6 → fixed in 8.0.7; +9 more packages - NuGet Client Security Feature Bypass Vulnerability CVE-2024-0057 CVSS 9.1 Critical
NuGet.CommandLine>= 4.6.0, < 5.11.6 → fixed in 5.11.6;NuGet.Packaging>= 4.6.0, < 5.11.6 → fixed in 5.11.6;NuGet.CommandLine>= 6.0.0, < 6.0.6 → fixed in 6.0.6; +11 more packages