Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A denial-of-service vulnerability in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows crafted YAML OpenAPI documents with nested anchors and aliases to cause excessive memory consumption and crash the parsing process.
Metalama on Linux and macOS trusts files in shared temporary directories without integrity checks, allowing local users to execute arbitrary code with the privileges of other users running builds.
A security feature bypass vulnerability in ASP.NET Core Kestrel allows aborted connections to reparse unread request-body bytes as new requests. This can lead to HTTP request smuggling or desynchronization attacks.
An information disclosure vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) affects .NET applications on Windows. Applications using vulnerable runtime packages may expose sensitive information through unsafe XAML and XPS operations.
A vulnerability in Microsoft WindowsDesktop App Runtime (WPF) can lead to information disclosure through improper origin validation. Developers should update affected packages and .NET installations to mitigate the issue.
A vulnerability in .NET Core App Runtime and System.Private.CoreLib on Linux and macOS allows local attackers to manipulate Unix named-mutex and shared-memory paths to overwrite files, widen permissions, or elevate privileges.
A vulnerability in System.Net.Http allows SocketsHttpHandler to retain proxy authorization headers during an HTTP redirect. This can lead to information disclosure by leaking basic proxy credentials to the destination server.
A vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows crafted pixel-shader bytecode to cause heap out-of-bounds writes or reads, potentially leading to remote code execution.
A remote code execution vulnerability in Microsoft WindowsDesktop App Runtime allows attacker-controlled content to be reached via WPF XPS synthetic hyperlinks exposed through UI Automation. Successful exploitation requires user interaction and affects supported .NET applications.
A remote code execution vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows crafted pixel-shader bytecode to desynchronize parsing passes, leading to heap out-of-bounds memory corruption. Patched runtime and SDK versions have been released to resolve the issue.
A denial of service vulnerability in ASP.NET Core Kestrel allows unauthenticated remote attackers to trigger deadlocks in connection handling, causing thread exhaustion and server resource depletion.
A remote code execution vulnerability exists in .NET and Visual Studio due to improper untrusted data deserialization in Windows Desktop runtime packages. Applications using affected runtime versions should be updated to patched releases and recompiled if deployed as self-contained applications.
A vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows attacker-controlled XPS glyph coordinates to overflow pointer arithmetic, causing an out-of-bounds write and process termination.
A spoofing vulnerability in System.Security.Cryptography.Xml allows serialized certificates with attacker-controlled chain metadata to be accepted, enabling certificate forgery and token spoofing. Mitigation requires updating .NET runtimes, SDKs, and affected package references.
An elevation of privilege vulnerability in Microsoft.AspNetCore.Authentication.Negotiate allows authenticated identities to be linked to unintended LDAP principals when SID verification fails. Affected systems should apply the latest .NET updates.
A vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server allows cross-origin script injection due to unencoded exception text in the Blazor development server debug page.
A denial of service vulnerability exists in .NET and Visual Studio packages System.Security.Cryptography.Xml and System.Private.Xml due to unbounded resource allocation. Remediate by updating packages and runtimes.
A Use After Free flaw in Microsoft.Native.Quic.MsQuic.Schannel on Windows exposes .NET applications to information disclosure. Developers should update to the latest .NET release or reference the patched package, then restart or recompile affected apps.
A denial of service vulnerability in Microsoft .NET's System.Security.Cryptography.Xml and System.Private.Xml allows asymmetric resource consumption. Developers should update affected packages or runtimes to the patched versions and recompile self-contained apps.
A denial of service vulnerability in ASP.NET Core SignalR components allows stateful reconnect clients to indefinitely block broadcasts and retain associated resources.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.