NuGet vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-24070HighMicrosoft.AspNetCore.Identity: Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability CVE-2025-27602MediumUmbraco.Cms.Web.Backoffice: Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content CVE-2025-27601MediumUmbraco.Cms.Api.Management: Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality CVE-2025-24043Highdotnet-sos: Microsoft Security Advisory CVE-2025-24043 | WinDbg Remote Code Execution Vulnerability GHSA-VC29-VG52-6643HighOpenTelemetry.AutoInstrumentation: DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api CVE-2025-27598HighSixLabors.ImageSharp: Out-of-bounds Write in SixLabors ImageSharp CVE-2025-27513MediumOpenTelemetry.Api: OpenTelemetry .NET has Denial of Service (DoS) Vulnerability in API Package CVE-2024-42512MediumOPCFoundation.NetStandard.Opc.Ua.Core: Security Update for the OPC UA .NET Standard Stack CVE-2024-42513MediumOPCFoundation.NetStandard.Opc.Ua.Bindings.Https: Security Update for the OPC UA .NET Standard Stack CVE-2024-57716MediumAutoQueryable: AutoQueryable leaks sensitive information CVE-2025-26620MediumDuende.AccessTokenManagement: Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens CVE-2025-24895CriticalCIE.AspNetCore.Authentication: AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass CVE-2025-24894CriticalSPID.AspNetCore.Authentication: The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass GHSA-F8MX-CWFH-7HR2Mediumtshock: TShock allows chat while not fully connected, possible ban evasion CVE-2025-24788MediumSnowflake.Data: Snowflake.Data has weak temporary files permissions CVE-2024-51417HighSystem.Linq.Dynamic.Core: Property reflection in System.Linq.Dynamic.Core CVE-2024-10761MediumUmbraco.Cms: XSS/HTML Injection Vulnerability in Umbraco Preview Badge CVE-2025-24011MediumUmbraco.Cms: Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes CVE-2025-24012MediumUmbraco.Cms.StaticAssets: XSS/HTML Injection Vulnerability in Umbraco Backoffice Components CVE-2025-21176HighMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21172HighMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability CVE-2025-21171HighMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability CVE-2025-23041MediumUmbraco.Forms: Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length CVE-2024-50338Highgit-credential-manager: Git Credential Manager carriage-return character in remote URL allows malicious repository to leak credentials GHSA-MGR7-5782-6JH9LowUmbraco.Headless.Client.Net: The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.