Tagged “ghsa”
CVEs tagged ghsa, newest first.
5683 CVEsRSS
CVE-2026-96230High· 8.8PoCImproper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-96229Medium· 6.5Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-96225High· 7.8Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96224High· 8.8Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-96222High· 7.4Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-88092Critical· 9.4Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVE-2026-87697High· 8.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-86063High· 8.8Claude Code is an agentic coding tool
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-charact…
CVE-2026-85790Medium· 5.9Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-85747Medium· 6.8PoCDistribution is a toolkit to pack, ship, store, and deliver container content
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest witho…
CVE-2026-85363High· 8.8Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-84994High· 8.7Qwik is a performance-focused JavaScript framework
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.r…
CVE-2026-84008High· 7.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-83520High· 8.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70197High· 8.1Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70196Medium· 5.9Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70194Medium· 6.5Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70188Critical· 9.1Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70186High· 7.5Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70183High· 7.5Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70181High· 7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70179High· 7.5Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70175High· 8.1Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-70174High· 8.8Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70162Medium· 5.9A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web applicati…
CVE-2026-70159High· 7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70035High· 8.8Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-70007High· 8.8Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-69651High· 7.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-66822Medium· 5.9Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.