NuGet vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-46559MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.CVE-2026-46557MediumMagick.NET-Q16-AnyCPU: ImageMagick: Stack overflow in fx operation CVE-2026-46523MediumMagick.NET-Q16-AnyCPU: ImageMagick: Use-After-Free in MSL decoder.CVE-2026-46522HighMagick.NET-Q16-AnyCPU: ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion CVE-2026-46521MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression CVE-2026-46520HighMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions CVE-2026-45664MediumMagick.NET-Q16-AnyCPU: ImageMagick: Policy Bypass in MNG coder could CVE-2026-45624MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.CVE-2026-35433HighMicrosoft.WindowsDesktop.App.Runtime.win-arm64: Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability CVE-2026-42899HighMicrosoft.AspNetCore.App.Runtime.win-arm: Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability CVE-2026-32175HighMicrosoft.NetCore.App.Runtime.win-arm: Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability CVE-2026-45031MediumMagick.NET-Q16-AnyCPU: ImageMagick: Policy Bypass in PSD decoder CVE-2026-45358MediumMagick.NET-Q16-AnyCPU: ImageMagick: Out-of-Bounds Read of a single byte in meta encoder CVE-2026-45359MediumMagick.NET-Q16-AnyCPU: ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define GHSA-5R97-79VW-QVM4Mediumdirectxtk12_desktop_win10: Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds GHSA-C55G-RP4X-FX84Mediumdirectxtk_desktop_win10: Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds CVE-2026-42326MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Read in IPTC encoder CVE-2026-45288CriticalMarten: Marten has an injection vulnerability in its full-text search regConfig parameter GHSA-88Q9-CMP2-C2VQMediumoxidize-pdf: oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)CVE-2026-44788MediumSharpCompress: SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)CVE-2026-44213MediumOpenTelemetry.Exporter.Instana: OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured CVE-2026-44503Highcom.microsoft.kiota:microsoft-kiota-abstractions: Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-44375HighNerdbank.MessagePack: Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException CVE-2026-44302HighSnappier: Snappier has an infinite loop during SnappyStream decompression with malformed framed input CVE-2026-42348MediumOpenTelemetry.OpAmp.Client: OpAMP client reads unbounded HTTP response bodies

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo