NuGet vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-53466MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflowCVE-2026-32203HighSystem.Security.Cryptography.Xml: Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service VulnerabilityCVE-2026-54632HighSIPSorcery: SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)GHSA-464C-974J-9XM6Lowaws-cdk-lib: AWS CDK CodeBuild S3 Log Encryption Boolean InversionCVE-2026-62946MediumMagick.NET-Q16-AnyCPU: ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit buildsCVE-2026-62363MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write in fx operationCVE-2026-62343MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is providedGHSA-P5RM-JG5C-8C77MediumMicrosoft.OpenApi.Kiota: Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)CVE-2026-59866HighMicrosoft.OpenApi.Kiota: Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameCVE-2026-59865CriticalMicrosoft.OpenApi.Kiota: Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`CVE-2026-59863HighMicrosoft.OpenApi.Kiota: Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRFCVE-2026-59867HighMicrosoft.OpenApi.Kiota: Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refCVE-2026-59864CriticalMicrosoft.OpenApi.Kiota: Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensionsCVE-2026-59859HighMicrosoft.OpenApi.Kiota: Microsoft Kiota: Code Generation Literal Injection in Kiota PHP GeneratorCVE-2026-59862HighMicrosoft.OpenAPI.Kiota: Microsoft Kiota: Code Generation Literal Injection in Kiota Python GeneratorCVE-2026-59861HighMicrosoft.OpenAPI.Kiota: Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby GeneratorGHSA-76Q6-2P6H-XJQRLowMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write in X11 import with crafted window titleCVE-2026-59860HighMicrosoft.OpenApi.Kiota: Microsoft Kiota: XML Doc-Comment Newline Breakout Code InjectionGHSA-H5R4-W88W-7CCRLowMagick.NET-Q16-AnyCPU: ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specifiedGHSA-H58X-R7F7-RH84LowMagick.NET-Q16-AnyCPU: ImageMagick: Memory Leak in ICON decoder when allocation failsGHSA-M596-67P7-69WHLowMagick.NET-Q16-AnyCPU: ImageMagick: Memory leak in VIFF encoder when allocation failsGHSA-R628-69V2-2F9CLowMagick.NET-Q16-AnyCPU: ImageMagick: Memory Leak in MIFF encoder when allocaton failsGHSA-H7F2-F9CC-H2GVLowMagick.NET-Q16-AnyCPU: ImageMagick: Memory Leak in YUV decoder when opening of blob failsGHSA-JFQ9-Q63X-RC63LowMagick.NET-Q16-AnyCPU: ImageMagick: Memory Leak in TIFF encoder when an allocation failsGHSA-99W9-HV66-RFV7LowMagick.NET-Q16-AnyCPU: ImageMagick: Memory Leak in JNG encoder when a blob could not be opened

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo