Schwachstellen verstehen. Anwendungen schützen.

Mittel 14.10.2026

CVE-2026-62847

Metalama ermöglicht lokale Codeausführung durch DLL-Planting in gemeinsam genutzten temporären Verzeichnissen

In Metalama unter Linux und macOS können lokale Angreifer über gemeinsam genutzte temporäre Verzeichnisse schädliche DLLs ablegen, die bei nachfolgenden Builds mit den Rechten des ausführenden Kontos ausgeführt werden.

.NET (NuGet)

metalama.framework, metalama.tool

Mittel 24.07.2026

CVE-2026-73851

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

.NET (NuGet)

microsoft.openapi.kiota

Hoch 15.07.2026

CVE-2026-50273

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

.NET (NuGet)

datadog.trace, datadog.trace.opentracing

Mittel 02.07.2026

CVE-2026-50267

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

.NET (NuGet)

steeltoe.configuration.abstractions

Mittel 25.06.2026

CVE-2026-48513

MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

.NET (NuGet)

messagepack

Hoch 25.06.2026

CVE-2026-48506

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

.NET (NuGet)

messagepack

Mittel 16.06.2026

CVE-2026-45491

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

.NET (NuGet)

microsoft.netcore.app.runtime.linux-x64, microsoft.netcore.app.runtime.osx-arm64, microsoft.netcore.app.runtime.win-x64

Hoch 05.06.2026

CVE-2026-47761

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

Composer npm .NET (NuGet)

tinymce/tinymce, tinymce

Hoch 05.06.2026

CVE-2026-47762

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

Composer npm .NET (NuGet)

tinymce/tinymce, tinymce

Hoch 05.06.2026

CVE-2026-47759

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

Composer npm .NET (NuGet)

tinymce/tinymce, tinymce

Mittel 29.05.2026

ghsa-qjvr-435c-5fjh

Nerdbank.MessagePack has a memory amplification DoS in collection deserialization

.NET (NuGet)

nerdbank.messagepack

Mittel 11.05.2026

ghsa-88q9-cmp2-c2vq

oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)

.NET (NuGet) Python (PyPI)

oxidizepdf.net, oxidize-pdf

Mittel 08.05.2026

CVE-2026-44788

SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)

.NET (NuGet)

sharpcompress

Hoch 07.05.2026

CVE-2026-44503

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Java / Kotlin (Maven) npm .NET (NuGet) Python (PyPI)

com.microsoft.kiota:microsoft-kiota-abstractions, kiota-typescript, microsoft.kiota.abstractions +1

Hoch 06.05.2026

CVE-2026-44302

Snappier has an infinite loop during SnappyStream decompression with malformed framed input

.NET (NuGet)

snappier

Hoch 05.05.2026

CVE-2026-43937

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

.NET (NuGet)

yafnet.core

Hoch 05.05.2026

CVE-2026-43938

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

.NET (NuGet)

yafnet.core

Mittel 30.04.2026

CVE-2026-42191

OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter

.NET (NuGet)

opentelemetry.exporter.opentelemetryprotocol

Mittel 23.04.2026

CVE-2026-40894

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

.NET (NuGet)

opentelemetry.api, opentelemetry.extensions.propagators

Mittel 23.04.2026

CVE-2026-40891

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

.NET (NuGet)

opentelemetry.exporter.opentelemetryprotocol

Mittel 22.04.2026

CVE-2026-41511

OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

.NET (NuGet)

openmcdf

Hoch 16.04.2026

ghsa-f5v8-v6q3-q4h6

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

.NET (NuGet)

meridian.mapping, meridian.mediator

Mittel 24.03.2026

CVE-2026-74786

Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString

.NET (NuGet)

scriban, scriban.signed

Hoch 27.02.2026

CVE-2026-27449

Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

.NET (NuGet)

umbraco.engage.forms