CVE-2026-120796

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 1 more

CVE-2026-114147

ASP.NET Core Denial of Service Vulnerability

Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 14 more

CVE-2026-114150

ASP.NET Core Information Disclosure Vulnerability

Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 1 more

CVE-2026-114146

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 13 more

CVE-2026-114149

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 13 more

CVE-2026-114156

ASP.NET Core Security Feature Bypass Vulnerability

Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 1 more

CVE-2026-109475

.NET Denial of Service Vulnerability

Stack-based buffer overflow in .NET allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 11.0 Installed On Linux and 5 more

CVE-2026-109476

ASP.NET Core Information Disclosure Vulnerability

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 12 more

CVE-2026-109481

ASP.NET Core Elevation of Privilege Vulnerability

Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 1 more

CVE-2026-118749

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 2 more

CVE-2026-118748

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows and 1 more

CVE-2026-118746

.NET Security Feature Bypass Vulnerability

Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 11.0 Installed On Linux .net 11.0 Installed On Mac Os

CVE-2026-114155

.NET Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 11.0 Installed On Linux and 2 more

CVE-2026-105544

.NET Elevation of Privilege Vulnerability

Improper access control in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 14 more

CVE-2026-70175

ASP.NET Core Elevation of Privilege Vulnerability

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 16 more

CVE-2026-70197

.NET and Visual Studio Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net 10.0 Installed On Linux .net 10.0 Installed On Mac Os and 16 more

CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft Redhat

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 12 more

CVE-2026-102870

ASP.NET Core Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 10 more