NuGet vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2024-35255Mediumazure-identity: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityCVE-2024-35252HighMicrosoft.Azure.Storage.DataMovement: Azure Storage Movement Client Library Denial of Service VulnerabilityCVE-2024-35240MediumUmbraco.Commerce: Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print FunctionalityCVE-2024-35239LowUmbraco.Forms: Umbraco Forms components vulnerable to Stored Cross-site ScriptingCVE-2024-35218MediumUmbracoCms.Core: Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview PaneCVE-2024-34071MediumUmbracoCms.Core: Umbraco CMS Open Redirect Bypass Protection CVE-2024-30046MediumMicrosoft.AspNetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service VulnerabilityCVE-2024-30045MediumMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution VulnerabilityCVE-2024-30054MediumMicrosoft.PowerBI.JavaScript: Microsoft Power BI Client JavaScript SDK Information Disclosure VulnerabilityCVE-2024-30171Mediumorg.bouncycastle:bctls-fips: Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")CVE-2024-30172MediumBouncyCastle: Bouncy Castle crafted signature and public key can be used to trigger an infinite loopCVE-2024-29857Mediumorg.bouncycastle:bcprov-jdk18on: Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.CVE-2024-32655HighNpgsql: Npgsql vulnerable to SQL Injection via Protocol Message Size OverflowCVE-2024-32872MediumUmbraco.Workflow: Umbraco Workflow's Backoffice users can execute arbitrary SQLCVE-2024-21409HighMicrosoft.WindowsDesktop.App.Runtime.win-arm64: .NET Elevation of Privilege VulnerabilityCVE-2024-29035MediumUmbraco.Cms.Core: Blind SSRF Leads to Port Scan by using WebhooksCVE-2024-27086LowMicrosoft.Identity.Client: MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of serviceCVE-2024-32036MediumSixLabors.ImageSharp: SixLabors.ImageSharp vulnerable to data leakageCVE-2024-32035MediumSixLabors.ImageSharp: SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size ValueCVE-2024-32028MediumOpenTelemetry.Instrumentation.Http: Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreCVE-2024-29992MediumAzure.Identity: Azure Identity Library for .NET Information Disclosure VulnerabilityCVE-2024-29203Mediumtinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframesCVE-2024-29881Mediumtinymce/tinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementsCVE-2024-29187Highwix: WiX based installers are vulnerable to binary hijack when run as SYSTEMCVE-2024-29188Highwix: Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo