Conoce las vulnerabilidades. Protege tus aplicaciones.

Alta 14.10.2026

CVE-2026-72923

Microsoft.OpenApi.YamlReader vulnerable a denegación de servicio mediante expansión de alias YAML

Una vulnerabilidad de denegación de servicio en Microsoft.OpenApi.YamlReader y Microsoft.OpenApi.Readers permite que documentos OpenAPI en YAML manipulados causen un consumo excesivo de memoria mediante anclas y alias anidados, provocando la caída del proceso.

.NET (NuGet)

microsoft.openapi.readers, microsoft.openapi.yamlreader

Media 07.10.2026

CVE-2026-106111

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

.NET (NuGet)

sixlabors.imagesharp

Alta 07.10.2026

CVE-2026-106118

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

.NET (NuGet)

imagesharp

Alta 07.10.2026

CVE-2026-106117

ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

.NET (NuGet)

imagesharp

Alta 22.09.2026

CVE-2026-61570

MPXJ: XXE Vulnerability in MerlinReader

Java / Kotlin (Maven) .NET (NuGet) Python (PyPI)

net.sf.mpxj:mpxj, mpxj.net, net.sf.mpxj +3

Media 24.07.2026

CVE-2026-73851

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

.NET (NuGet)

microsoft.openapi.kiota

Alta 24.07.2026

CVE-2026-59862

Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

.NET (NuGet)

microsoft.openapi.kiota, microsoft.openapi.kiota.builder

Alta 24.07.2026

CVE-2026-59860

Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

.NET (NuGet)

microsoft.openapi.kiota, microsoft.openapi.kiota.builder

Media 17.07.2026

CVE-2026-54570

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

.NET (NuGet)

anglesharp

Alta 30.06.2026

CVE-2026-49451

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

.NET (NuGet)

microsoft.openapi

Media 26.06.2026

CVE-2026-74783

Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)

.NET (NuGet)

scriban, scriban.signed

Media 25.06.2026

CVE-2026-48517

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

.NET (NuGet)

messagepack

Media 25.06.2026

CVE-2026-48516

MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

.NET (NuGet)

messagepack

Media 25.06.2026

CVE-2026-48515

MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions

.NET (NuGet)

messagepack

Media 25.06.2026

CVE-2026-48514

MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

.NET (NuGet)

messagepack

Media 25.06.2026

CVE-2026-48513

MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement

.NET (NuGet)

messagepack

Media 25.06.2026

CVE-2026-48512

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

.NET (NuGet)

messagepack

Media 25.06.2026

CVE-2026-48511

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

.NET (NuGet)

messagepack

Media 25.06.2026

CVE-2026-48510

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

.NET (NuGet)

messagepack

Alta 25.06.2026

CVE-2026-48506

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

.NET (NuGet)

messagepack

Alta 25.06.2026

CVE-2026-48502

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

.NET (NuGet)

messagepack

Alta 11.06.2026

CVE-2026-48109

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

.NET (NuGet)

messagepack

Alta 05.06.2026

CVE-2026-47760

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

Composer npm .NET (NuGet)

tinymce/tinymce, tinymce

Media 29.05.2026

ghsa-qjvr-435c-5fjh

Nerdbank.MessagePack has a memory amplification DoS in collection deserialization

.NET (NuGet)

nerdbank.messagepack