NuGet vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-21176HighMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21172HighMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21171HighMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability CVE-2025-23041MediumUmbraco.Forms: Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length CVE-2024-50338Highgit-credential-manager: Git Credential Manager carriage-return character in remote URL allows malicious repository to leak credentials GHSA-MGR7-5782-6JH9LowUmbraco.Headless.Client.Net: The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package CVE-2024-55341MediumPiranha: Piranha CMS Cross-site Scripting vulnerability CVE-2024-55342MediumPiranha: Piranha CMS Cross-site Scripting vulnerability CVE-2024-55186LowOqtane.Framework: Oqtane Framework Insecure Direct Object Reference vulnerability CVE-2024-55471MediumOqtane.Framework: Oqtane Framework Insecure Direct Object Reference vulnerability CVE-2024-55470HighOqtane.Framework: Oqtane Framework Incorrect Access Control vulnerability GHSA-HVM9-WC8J-MGRCHighTShock: TShock Security Escalation Exploit CVE-2024-11862MediumDevolutions.XTS.NET: Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications CVE-2024-48510HighDotNetZip: DotNetZip Directory Traversal vulnerability CVE-2024-43498CriticalSystem.Formats.Nrbf: .NET Remote Code Execution Vulnerability CVE-2024-43499HighSystem.Formats.Nrbf: .NET Denial of Service Vulnerability CVE-2024-51987MediumDuende.AccessTokenManagement.OpenIdConnect: HTTP Client uses incorrect token after refresh CVE-2024-51501CriticalRefit: CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes CVE-2024-43383HighLucene.Net.Replicator: Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability CVE-2024-50353MediumICG.AspNetCore.Utilities.CloudStorage: ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected CVE-2024-49755LowDuende.IdentityServer: Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs CVE-2024-49771Mediumnet.sf.mpxj:mpxj: MPXJ has a Potential Path Traversal Vulnerability CVE-2024-48929MediumUmbraco.CMS: Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out CVE-2024-48927MediumUmbracoCms: Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice CVE-2024-48926MediumUmbraco.CMS: Umbraco CMS logout page displayed before session expiration

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo