NuGet vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-106116MediumSixLabors.ImageSharp: ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loopCVE-2026-106110HighSixLabors.ImageSharp: ImageSharp: TIFF CCITT T4 encoder can write past its compressed output bufferCVE-2026-106113HighSixLabors.ImageSharp: ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexCVE-2026-106114MediumSixLabors.ImageSharp: ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsCVE-2026-106118HighSixLabors.ImageSharp: ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB writeCVE-2026-106117HighImageSharp: ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in…CVE-2026-105795LowMicrosoft.OpenApi.Kiota: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsCVE-2026-105796HighMicrosoft.OpenApi.Kiota: Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generatorsCVE-2026-105794CriticalMicrosoft.Native.Quic.MsQuic.OpenSSL: MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLCVE-2026-100368HighCliInvoke.Specializations: CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappersCVE-2026-100369HighCliInvoke: CliInvoke: Argument Injection in Extensibility Runner FactoryCVE-2026-65829MediumMPXJ.Net: MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersCVE-2026-61570Highnet.sf.mpxj:mpxj: MPXJ: XXE Vulnerability in MerlinReaderCVE-2026-81868MediumSteeltoe.Security.Authorization.Certificate: Steeltoe: Header-forwarded client cert lacks proof of private-key possessionCVE-2026-81516HighSteeltoe.Discovery.Consul: Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)CVE-2026-81515HighSteeltoe.Discovery.Eureka: Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)CVE-2026-75523MediumSteeltoe.Management.Endpoint: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secretsCVE-2026-85756HighSSH.NET: SSH.NET: ScpClient allows server-side RCE via default SCP path handlingCVE-2026-69197HighUmbraco.Cms: Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansionCVE-2026-75513CriticalMarten: Marten's LINQ provider has SQL injection via unescaped string literalsCVE-2026-81192HighOpenTelemetry.Resources.Host: OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSCVE-2026-69304MediumMicrosoft.AspNetCore.Server.IISIntegration: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service VulnerabilityCVE-2026-69522HighMicrosoft.DiaSymReader.Native: Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution VulnerabilityCVE-2026-69439HighMicrosoft.DiaSymReader.Native: Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2026-71328HighMicrosoft.DiaSymReader.Native: Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo