HighCVSS 7.5
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
Product
Microsoft net framework vulnerabilities
186 published CVES affecting Microsoft net framework, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 186
- Critical
- 4
- High
- 138
- Medium
- 42
- Low
- 2
- Unscored
- 0
- CISA KEV
- 4
Latest Microsoft net framework CVEs
Newest publication first · page 1 of 8
-
-
HighCVSS 8.8
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
-
HighCVSS 7.5
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
-
CVE-2026-97788 Active Directory Federation Services (AD FS) Information Disclosure Vulnerability
PublishedHighCVSS 7.5Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
-
HighCVSS 7.5
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
-
HighCVSS 7.5
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
-
HighCVSS 7.5
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
HighCVSS 7.5
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
HighCVSS 8.8
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
-
HighCVSS 7.5
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
HighCVSS 8.8
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
-
HighCVSS 8.8
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
-
HighCVSS 8.8
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
-
HighCVSS 8.8
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.4
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
HighCVSS 8.8
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.5
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
HighCVSS 8.8
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
-
HighCVSS 8.8
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
-
HighCVSS 7.8
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
-
HighCVSS 7.8
Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
-
HighCVSS 7.8
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
-
HighCVSS 8.8
Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
-
HighCVSS 7.0
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
-
MediumCVSS 6.5
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.