Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-96222High· 7.4Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-88092Critical· 9.4Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVE-2026-87697High· 8.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-86063High· 8.8Claude Code is an agentic coding tool
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-charact…
CVE-2026-85363High· 8.8Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-84008High· 7.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-83520High· 8.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70197High· 8.1Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70196Medium· 5.9Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70190High· 7.3Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70188Critical· 9.1Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70186High· 7.5Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70183High· 7.5Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70181High· 7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70179High· 7.5Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70175High· 8.1Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-70174High· 8.8Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70162Medium· 5.9A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web applicati…
CVE-2026-70161High· 7.3Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70159High· 7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70035High· 8.8Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-70007High· 8.8Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-69651High· 7.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-66822Medium· 5.9Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-58280High· 7.5Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-110249Medium· 5.3⚖ disputedA malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability …
CVE-2026-110247High· 8.8Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a s…
CVE-2026-110237High· 7.3Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm…
CVE-2026-110220High· 7.1PoCKubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create …
CVE-2026-110036Low· 3.3PoCA flaw was found in device-mapper-persistent-data
A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error…