---
title: "Critical NuGet advisories"
url: https://erroneo.us/security/ecosystem/nuget/
description: "All 32 critical GitHub-reviewed NuGet security advisories since October 2023, newest first, with vulnerable ranges and fixed versions."
type: ecosystem
section: "Security Digest"
date_modified: 2026-10-13
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical NuGet advisories

- 2026-10-13 [CVE-2026-88092](https://erroneo.us/security/cve/CVE-2026-88092/index.md) Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability — Microsoft.AspNetCore.App.Runtime.linux-arm >= 8.0.0, <= 8.0.31 → 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 8.0.0, <= 8.0.31 → 8.0.32; Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 8.0.0, <= 8.0.31 → 8.0.32
- 2026-10-13 [CVE-2026-70188](https://erroneo.us/security/cve/CVE-2026-70188/index.md) Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability — Microsoft.AspNetCore.App.Runtime.linux-arm >= 11.0.0-preview.1, <= 11.0.0-rc.1 → 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 11.0.0-preview.1, <= 11.0.0-rc.1 → 11.0.0-rc.2; Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 11.0.0-preview.1, <= 11.0.0-rc.1 → 11.0.0-rc.2
- 2026-10-13 [CVE-2026-105016](https://erroneo.us/security/cve/CVE-2026-105016/index.md) Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability — Microsoft.Native.Quic.MsQuic.Schannel = 2.5.11-ci.156755675 → 2.5.11-ci.159417053
- 2026-10-06 [CVE-2026-105794](https://erroneo.us/security/cve/CVE-2026-105794/index.md) MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL — Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.20 → 2.4.20; Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.0, < 2.5.11 → 2.5.11; Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.6.0, < 2.6.1 → 2.6.1
- 2026-09-17 [CVE-2026-75513](https://erroneo.us/security/cve/CVE-2026-75513/index.md) Marten's LINQ provider has SQL injection via unescaped string literals — Marten >= 7.0.0, <= 9.12.0 → 9.13.0
- 2026-09-08 [CVE-2026-62815](https://erroneo.us/security/cve/CVE-2026-62815/index.md) Microsoft QUIC: Remote Code Execution Vulnerability — Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.3, < 2.5.10 → 2.5.10; Microsoft.Native.Quic.MsQuic.Schannel >= 2.5.3, < 2.5.10 → 2.5.10; Microsoft.Native.Quic.MsQuic.OpenSSL < 2.4.19 → 2.4.19
- 2026-07-24 [CVE-2026-59865](https://erroneo.us/security/cve/CVE-2026-59865/index.md) Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` — Microsoft.OpenApi.Kiota >= 1.30.0, < 1.32.5 → 1.32.5; Microsoft.OpenApi.Kiota.Builder >= 1.30.0, < 1.32.5 → 1.32.5; Microsoft.OpenApi.Kiota < 1.29.1 → 1.29.1
- 2026-07-24 [CVE-2026-59864](https://erroneo.us/security/cve/CVE-2026-59864/index.md) Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions — Microsoft.OpenApi.Kiota >= 1.30.0, < 1.32.5 → 1.32.5; Microsoft.OpenApi.Kiota.Builder >= 1.30.0, < 1.32.5 → 1.32.5; Microsoft.OpenApi.Kiota < 1.29.1 → 1.29.1
- 2026-06-19 [CVE-2026-54782](https://erroneo.us/security/cve/CVE-2026-54782/index.md) CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation — CoreWCF.Primitives < 1.8.1 → 1.8.1; CoreWCF.Primitives >= 1.9.0, < 1.9.1 → 1.9.1
- 2026-06-19 [GHSA-c8qj-jx8j-fg2w](https://erroneo.us/security/ghsa/GHSA-c8qj-jx8j-fg2w/index.md) DotVVM: Missing authorization in AuthorizeActionFilter — DotVVM < 4.2.11 → 4.2.11; DotVVM > 4.3.0-preview01-final, < 4.3.15 → 4.3.15; DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final → 5.0.0-preview09-final
- 2026-05-14 [CVE-2026-45288](https://erroneo.us/security/cve/CVE-2026-45288/index.md) Marten has an injection vulnerability in its full-text search regConfig parameter — Marten <= 8.36 → 8.37.0
- 2026-04-23 [CVE-2026-40372](https://erroneo.us/security/cve/CVE-2026-40372/index.md) Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege — Microsoft.AspNetCore.DataProtection >= 10.0.0, <= 10.0.6 → 10.0.7
- 2026-04-16 [CVE-2026-40324](https://erroneo.us/security/cve/CVE-2026-40324/index.md) ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents — HotChocolate.Language < 12.22.7 → 12.22.7; HotChocolate.Language >= 13.0.0, < 13.9.16 → 13.9.16; HotChocolate.Language >= 14.0.0, < 14.3.1 → 14.3.1
- 2026-04-15 [CVE-2026-32179](https://erroneo.us/security/cve/CVE-2026-32179/index.md) MsQuic has a Remote Elevation of Privilege Vulnerability — Microsoft.Native.Quic.MsQuic.OpenSSL >= 2.5.0-ci.532574, < 2.5.7 → 2.5.7; Microsoft.Native.Quic.MsQuic.Schannel >= 2.5.0-ci.532574, < 2.5.7 → 2.5.7; Microsoft.Native.Quic.MsQuic.Schannel < 2.4.18 → 2.4.18
- 2026-03-24 [GHSA-5wr9-m6jw-xx44](https://erroneo.us/security/ghsa/GHSA-5wr9-m6jw-xx44/index.md) Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse — scriban < 7.0.0 → 7.0.0; Scriban.Signed < 7.0.0 → 7.0.0
- 2026-02-06 [CVE-2026-25592](https://erroneo.us/security/cve/CVE-2026-25592/index.md) Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK — semantic-kernel < 1.39.3 → 1.39.3; Microsoft.SemanticKernel.Core < 1.71.0 → 1.71.0
- 2026-01-28 [CVE-2026-24838](https://erroneo.us/security/cve/CVE-2026-24838/index.md) DotNetNuke.Core Vulnerable to Stored XSS via Module Title — DotNetNuke.Core < 9.13.10 → 9.13.10; DotNetNuke.Core >= 10.0.0, < 10.2.0 → 10.2.0
- 2026-01-13 [CVE-2025-68924](https://erroneo.us/security/cve/CVE-2025-68924/index.md) UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation — UmbracoForms <= 8.13.16 → no fix
- 2025-10-29 [CVE-2025-64095](https://erroneo.us/security/cve/CVE-2025-64095/index.md) DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite — DNN.PLATFORM < 10.1.1 → 10.1.1
- 2025-10-16 [CVE-2025-54539](https://erroneo.us/security/cve/CVE-2025-54539/index.md) Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability — Apache.NMS.AMQP < 2.4.0 → 2.4.0
- 2025-10-14 [CVE-2025-55315](https://erroneo.us/security/cve/CVE-2025-55315/index.md) Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability — Microsoft.AspNetCore.App.Runtime.linux-arm = 10.0.0-rc.1.25451.107 → 10.0.0-rc.2.25502.107; Microsoft.AspNetCore.App.Runtime.linux-arm64 = 10.0.0-rc.1.25451.107 → 10.0.0-rc.2.25502.107; Microsoft.AspNetCore.App.Runtime.linux-musl-arm = 10.0.0-rc.1.25451.107 → 10.0.0-rc.2.25502.107
- 2025-10-07 [CVE-2025-61778](https://erroneo.us/security/cve/CVE-2025-61778/index.md) Akka.Remote TLS did not properly implement certificate-based authentication — Akka.Remote >= 1.2.0, < 1.5.52 → 1.5.52; Akka.Cluster >= 1.2.0, < 1.5.52 → 1.5.52
- 2025-09-23 [CVE-2025-59545](https://erroneo.us/security/cve/CVE-2025-59545/index.md) DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module — DotNetNuke.Core < 10.1.0 → 10.1.0
- 2025-04-23 [CVE-2025-43858](https://erroneo.us/security/cve/CVE-2025-43858/index.md) YoutubeDLSharp allows command injection on windows system due to non sanitized arguments — YoutubeDLSharp >= 1.0.0-beta4, < 1.1.2 → 1.1.2
- 2025-04-18 [CVE-2025-29953](https://erroneo.us/security/cve/CVE-2025-29953/index.md) Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability — Apache.NMS.ActiveMQ < 2.1.1 → 2.1.1
- 2025-02-18 [CVE-2025-24895](https://erroneo.us/security/cve/CVE-2025-24895/index.md) AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass — CIE.AspNetCore.Authentication <= 2.0.4 → 2.1.0
- 2025-02-18 [CVE-2025-24894](https://erroneo.us/security/cve/CVE-2025-24894/index.md) The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass — SPID.AspNetCore.Authentication <= 3.3.0 → 3.4.0
- 2024-11-12 [CVE-2024-43498](https://erroneo.us/security/cve/CVE-2024-43498/index.md) .NET Remote Code Execution Vulnerability — System.Formats.Nrbf < 9.0.0 → 9.0.0
- 2024-11-04 [CVE-2024-51501](https://erroneo.us/security/cve/CVE-2024-51501/index.md) CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes — Refit < 7.2.22 → 7.2.22
- 2024-07-22 [CVE-2024-28698](https://erroneo.us/security/cve/CVE-2024-28698/index.md) CLSA Directory Traversal vulnerability — Csla < 5.5.4 → 5.5.4; Csla >= 6.0.0, <= 6.2.2 → 8.0.0; Csla >= 7.0.0, <= 7.0.5 → 8.0.0
- 2024-07-09 [CVE-2024-35264](https://erroneo.us/security/cve/CVE-2024-35264/index.md) Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability — Microsoft.AspNetCore.App.Runtime.linux-arm >= 8.0.0, <= 8.0.6 → 8.0.7; Microsoft.AspNetCore.App.Runtime.linux-arm64 >= 8.0.0, <= 8.0.6 → 8.0.7; Microsoft.AspNetCore.App.Runtime.linux-musl-arm >= 8.0.0, <= 8.0.6 → 8.0.7
- 2024-02-13 [CVE-2024-0057](https://erroneo.us/security/cve/CVE-2024-0057/index.md) NuGet Client Security Feature Bypass Vulnerability — NuGet.CommandLine >= 4.6.0, < 5.11.6 → 5.11.6; NuGet.Packaging >= 4.6.0, < 5.11.6 → 5.11.6; NuGet.CommandLine >= 6.0.0, < 6.0.6 → 6.0.6

---
Source page: https://erroneo.us/security/ecosystem/nuget/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt