Microsoft Net vulnerabilities

CVE-2026-26171 [HIGH] CWE-400 CVE-2026-26171: Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a net Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-50649 [HIGH] CWE-502 CVE-2026-50649: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

CVE-2026-45591 [HIGH] CWE-400 CVE-2026-45591: Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service ov Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-50646 [HIGH] CWE-502 CVE-2026-50646: Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

CVE-2026-42899 [HIGH] CWE-835 CVE-2026-42899: Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attack Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-62898 [HIGH] CWE-416 CVE-2026-62898: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a netw Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

CVE-2023-33170 [HIGH] CWE-362 CVE-2023-33170: ASP.NET and Visual Studio Security Feature Bypass Vulnerability ASP.NET and Visual Studio Security Feature Bypass Vulnerability

CVE-2026-33116 [HIGH] CWE-20 CVE-2026-33116: Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

CVE-2026-62901 [HIGH] CWE-606 CVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a ne Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-50524 [HIGH] CWE-1287 CVE-2026-50524: Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

CVE-2026-70354 [HIGH] CWE-787 CVE-2026-70354: Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

CVE-2026-96960 [HIGH] CWE-405 CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny serv Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-96958 [HIGH] CWE-407 CVE-2026-96958: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-50527 [HIGH] CWE-121 CVE-2026-50527: Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.

CVE-2026-56170 [HIGH] CWE-770 CVE-2026-56170: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-57108 [HIGH] CWE-843 CVE-2026-57108: Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized at Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-21218 [HIGH] CWE-166 CVE-2026-21218: Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoo Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

CVE-2020-1108 [HIGH] CVE-2020-1108: A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web req A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET Core or .NET Framework web application. The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could ex

CVE-2026-96222 [HIGH] CWE-295 CVE-2026-96222: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthoriz Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVE-2023-33127 [HIGH] CWE-1220 CVE-2023-33127: .NET and Visual Studio Elevation of Privilege Vulnerability .NET and Visual Studio Elevation of Privilege Vulnerability