visual_studio_2022_version_17.14 vulnerabilities
CVEs whose affected-version data names the visual_studio_2022_version_17.14 package (nuget). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
48 CVEsRSS
CVE-2026-109468High· 7.5ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-96957High· 8.8Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96238Medium· 6.5Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96237High· 7.5Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70197High· 8.1Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70196Medium· 5.9Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70194Medium· 6.5Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70190High· 7.3Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70188Critical· 9.1Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70183High· 7.5Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70181High· 7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70175High· 8.1Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-70165Medium· 6.7Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70162Medium· 5.9A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web applicati…
CVE-2026-70161High· 7.3Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-69651High· 7.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-58280High· 7.5Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-105016Critical· 9.8Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
CVE-2026-103572High· 8.8Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-102869High· 8.8Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69806High· 7.0Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-69522High· 8.8Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-69439High· 8.8Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62900Medium· 5.9.NET Information Disclosure Vulnerability
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62902Medium· 6.5.NET Information Disclosure Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62901High· 7.5.NET Denial of Service Vulnerability
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-62909High· 7.8.NET Elevation of Privilege Vulnerability
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70354High· 7.8.NET Core Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-62897High· 7.0.NET Framework Remote Code Execution Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-62871High· 7.8.NET Elevation of Privilege Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.