CVE-2026-70175

ASP.NET Core Elevation of Privilege Vulnerability

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 16 more

CVE-2026-96957

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 5 more

CVE-2026-96222

Active Directory Federation Services (AD FS) Spoofing Vulnerability

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 26 more

CVE-2026-85790

Microsoft QUIC Information Disclosure Vulnerability

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft.native.quic.msquic.schannel Microsoft Visual Studio 2026 and 17 more

CVE-2026-88092

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022 and 1 more

CVE-2026-58649

.NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 6 more

CVE-2026-69304

ASP.NET Core Denial of Service Vulnerability

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Asp.net Core Microsoft Visual Studio 2022 and 4 more

CVE-2026-69805

.NET Elevation of Privilege Vulnerability

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Diagnostics Runtime Microsoft.diagnostics.runtime Visual Studio 2022 and 1 more

CVE-2026-69806

.NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Linux Microsoft

Products

Linux Kernel .net Visual Studio 2022 and 1 more

CVE-2026-69439

.NET and Visual Studio Elevation of Privilege Vulnerability

Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Microsoft Visual Studio 2026 and 3 more

CVE-2026-71328

.NET and Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Visual Studio 2022 Visual Studio 2026 and 1 more

CVE-2026-77906

Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio 2026

CVE-2026-77907

Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio 2026

CVE-2026-69522

.NET and Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Visual Studio 2022 and 1 more

CVE-2026-62886

.NET Elevation of Privilege Vulnerability

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 and 4 more

CVE-2026-70354

.NET Core Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 and 17 more

CVE-2026-62899

.NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 5 more

CVE-2026-62901

.NET Denial of Service Vulnerability

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 5 more

CVE-2026-62902

.NET Information Disclosure Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Microsoft Visual Studio 2026 and 3 more

CVE-2026-62909

.NET Elevation of Privilege Vulnerability

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 5 more