CVE-2026-102870High· 8.8▾ TwilightImproper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.8%
0.8% → 0.9%
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
Microsoft.AspNetCore.Components.WebAssembly.Server >= 10.0.0, <= 10.0.12Microsoft.AspNetCore.Components.WebAssembly.Server >= 11.0.0-preview.1, <= 11.0.0-rc.1Patched in:
Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.13Microsoft.AspNetCore.Components.WebAssembly.Server 11.0.0-rc.2.26478.115Source: https://github.com/advisories/GHSA-g27p-qf6j-c96c
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96230High· 8.8Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-97801High· 7.5Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
CVE-2019-5443High· 7.8A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation
CVE-2021-23383Medium· 5.6The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
CVE-2021-23337High· 7.2Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-5258High· 7.7In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution