Vulnerabilities
Summary — last 7 days
New vulnerabilities2,774▼ 317 vs. last week
Critical / high1,288▼ 233 vs. last week
New active exploitation (KEV)6▼ 1 vs. last week
Unscored (no CVSS)214▼ 107 vs. last week
13 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.1) | 0.61% | — | Cie-aspnetcoreAI | 2/18/2025 | 6/17/2026 | CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: 1. Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in… | |
| Deferred | Critical (9.1) | 0.61% | — | Spid Aspnetcore AuthenticationAI | 2/18/2025 | 6/17/2026 | SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: Identity Provider (IDP): the system that authenticates users and provides identity information (SAML affirmation) to the Service Provider, in… | |
| Analyzed | Medium (5.3) | 0.30% | — | Iowacomputergurus Aspnetcore.utilities.cloudstorage | 10/30/2024 | 6/17/2026 | ICG.AspNetCore.Utilities.CloudStorage is a collection of cloud storage utilities to assist with the management of files for cloud upload. Users of this library that set a duration for a SAS Uri with a value other than 1 hour may have generated a URL with a duration that is longer, or shorter than desired. Users not… | |
| Deferred | Medium (6.9) | 0.32% | — | Amazon Applicationloadbalancer Identity AspnetcoreAIMicrosoft Aspnet CoreAI | 10/22/2024 | 6/17/2026 | The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcore#validatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer (ALB) OpenId Connect integration and can be used in any ASP.NET… | |
| Deferred | Medium (4.1) | 0.29% | — | Opentelemetry Instrumentation.httpAIOpentelemetry Instrumentation.aspnetcoreAI | 4/12/2024 | 6/17/2026 | OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore`… | |
| Modified | Medium (6.1) | 0.46% | — | Aspnetzero Asp.net Zero | 12/26/2023 | 6/17/2026 | An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' in the WebSocket messages. | |
| Modified | High (7.5) | 1.7% | — | Elfinder.aspnet Project Elfinder.aspnet | 7/28/2021 | 6/17/2026 | This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path. | |
| Modified | High (8.8) | 0.49% | — | Auth0 AspnetAuth0 Aspnet-owin | 8/29/2018 | 6/17/2026 | An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations. | |
| Modified | High (7.5) | 8.5% | — | Microsoft Aspnetcore | 11/15/2017 | 6/17/2026 | .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability". | |
| Modified | High (7.5) | 5.4% | — | Microsoft Aspnetcore | 11/15/2017 | 6/17/2026 | .NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service… | |
| Modified | Medium (5.3) | 3.5% | — | Microsoft Asp.net Model View ControllerMicrosoft.aspnetcore.mvc.abstractionsMicrosoft.aspnetcore.mvc.apiexplorerMicrosoft.aspnetcore.mvc.cors+14 | 5/12/2017 | 6/17/2026 | A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. | |
| Modified | High (7.3) | 4.2% | — | Microsoft Asp.net Model View ControllerMicrosoft.aspnetcore.mvc.abstractionsMicrosoft.aspnetcore.mvc.apiexplorerMicrosoft.aspnetcore.mvc.cors+14 | 5/12/2017 | 6/17/2026 | An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. | |
| Modified | High (7.5) | 17% | — | Microsoft Asp.net Model View ControllerMicrosoft.aspnetcore.mvc.abstractionsMicrosoft.aspnetcore.mvc.apiexplorerMicrosoft.aspnetcore.mvc.cors+14 | 5/12/2017 | 6/17/2026 | A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3… |