Microsoft Net vulnerabilities
110 known vulnerabilities affecting microsoft/net.
Total CVEs
110
CISA KEV
2
actively exploited
Public exploits
1
Exploited in wild
3
Severity breakdown
CRITICAL4HIGH85MEDIUM21
Vulnerabilities
Page 4 of 6
CVE-2024-21409P3HIGHCVSS 7.3≥ 6.0.0, < 6.0.29≥ 7.0.0, < 7.0.18+1 more2024-04-09
CVE-2024-21409 [HIGH] CWE-416 CVE-2024-21409: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2021-31204P3HIGHCVSS 7.8≥ 5.0, ≤ 5.0.52021-05-11
CVE-2021-31204 [HIGH] CWE-269 CVE-2021-31204: .NET and Visual Studio Elevation of Privilege Vulnerability
.NET and Visual Studio Elevation of Privilege Vulnerability
nvd
CVE-2023-24936P3HIGHCVSS 7.5v6.0.0v7.0.02023-06-14
CVE-2023-24936 [HIGH] CVE-2023-24936: .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
nvd
CVE-2020-8927P3MEDIUMCVSS 6.5≥ 5.0, ≤ 5.0.142020-09-15
CVE-2020-8927 [MEDIUM] CWE-130 CVE-2020-8927: A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recomm
nvd
CVE-2025-55247P3HIGHCVSS 7.3≥ 8.0.0, < 8.0.21≥ 9.0.0, < 9.0.102025-10-14
CVE-2025-55247 [HIGH] CWE-59 CVE-2025-55247: Improper link resolution before file access ('link following') in .NET allows an authorized attacker
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2023-24897P3HIGHCVSS 7.8v6.0.0v7.0.02023-06-14
CVE-2023-24897 [HIGH] CWE-122 CVE-2023-24897: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2023-35391P3HIGHCVSS 7.5≥ 6.0.0, < 6.0.21≥ 7.0.0, < 7.0.102023-08-08
CVE-2023-35391 [HIGH] CVE-2023-35391: ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
nvd
CVE-2023-21808P3HIGHCVSS 7.8v6.0.0v7.0.02023-02-14
CVE-2023-21808 [HIGH] CWE-416 CVE-2023-21808: .NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2023-24895P3HIGHCVSS 7.8v6.0.0v7.0.02023-06-14
CVE-2023-24895 [HIGH] CVE-2023-24895: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
nvd
CVE-2024-43484P3HIGHCVSS 7.5≥ 6.0.0, < 6.0.35≥ 8.0.0, < 8.0.102024-10-08
CVE-2024-43484 [HIGH] CWE-407 CVE-2024-43484: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
nvd
CVE-2024-43483P3HIGHCVSS 7.5≥ 6.0.0, < 6.0.35≥ 8.0.0, < 8.0.102024-10-08
CVE-2024-43483 [HIGH] CWE-407 CVE-2024-43483: .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
nvd
CVE-2026-62899P3MEDIUMCVSS 5.9≥ 8.0.0, < 8.0.30≥ 9.0.0, < 9.0.19+1 more2026-08-11
CVE-2026-62899 [MEDIUM] CWE-444 CVE-2026-62899: Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an u
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2022-29117P3HIGHCVSS 7.5v5.0v6.0.02022-05-10
CVE-2022-29117 [HIGH] CWE-400 CVE-2022-29117: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd
CVE-2022-23267P3HIGHCVSS 7.5v5.0v6.0.02022-05-10
CVE-2022-23267 [HIGH] CVE-2022-23267: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd
CVE-2022-29145P3HIGHCVSS 7.5v5.0v6.0.02022-05-10
CVE-2022-29145 [HIGH] CWE-400 CVE-2022-29145: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd
CVE-2024-43485P3HIGHCVSS 7.5≥ 6.0.0, < 6.0.35≥ 8.0.0, < 8.0.102024-10-08
CVE-2024-43485 [HIGH] CWE-407 CVE-2024-43485: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd
CVE-2024-30105P3HIGHCVSS 7.5≥ 8.0.0, ≤ 8.0.72024-07-09
CVE-2024-30105 [HIGH] CWE-400 CVE-2024-30105: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd
CVE-2024-38095P3HIGHCVSS 7.5≥ 8.0.0, < 8.0.72024-07-09
CVE-2024-38095 [HIGH] CWE-20 CVE-2024-38095: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd
CVE-2024-38168P3HIGHCVSS 7.5≥ 8.0.0, < 8.0.82024-08-13
CVE-2024-38168 [HIGH] CWE-400 CVE-2024-38168: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd
CVE-2024-43499P3HIGHCVSS 7.5v9.0.02024-11-12
CVE-2024-43499 [HIGH] CWE-409 CVE-2024-43499: .NET and Visual Studio Denial of Service Vulnerability
.NET and Visual Studio Denial of Service Vulnerability
nvd