https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:29:48.532242+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:41893 ALSA-2026:41893 — Important: .NET 8.0 security, bug fix, and enhancement update 2026-10-02T16:29:48.706753+00:00

Affected: AlmaLinux:10: aspnetcore-runtime-8.0, AlmaLinux:10: aspnetcore-runtime-dbg-8.0, AlmaLinux:10: aspnetcore-targeting-pack-8.0, AlmaLinux:10: dotnet-apphost-pack-8.0, AlmaLinux:10: dotnet-hostfxr-8.0, AlmaLinux:10: dotnet-runtime-8.0, AlmaLinux:10: dotnet-runtime-dbg-8.0, AlmaLinux:10: dotnet-sdk-8.0, AlmaLinux:10: dotnet-sdk-8.0-source-built-artifacts, AlmaLinux:10: dotnet-sdk-dbg-8.0 and 2 more

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled re…

 https://cve.radiocsirt.org/vuln/bdu:2026-10971 bdu:2026-10971 2026-10-02T16:29:48.706858+00:00 bdu:2026-10971 https://cve.radiocsirt.org/vuln/bit-dotnet-2026-47304 BIT-dotnet-2026-47304 — .NET Security Feature Bypass Vulnerability 2026-10-02T16:29:48.706878+00:00

Affected: Bitnami: dotnet

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0872 certfr-2026-avi-0872 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at… 2026-10-02T16:29:48.706901+00:00 certfr-2026-avi-0872 https://cve.radiocsirt.org/vuln/euvd-2026-376613 EUVD-2026-376613 2026-10-02T16:29:48.706917+00:00 EUVD-2026-376613 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47304 fkie_cve-2026-47304 2026-10-02T16:29:48.706928+00:00

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

 https://cve.radiocsirt.org/vuln/ghsa-g8r8-53c2-pm3f GHSA-g8r8-53c2-pm3f — Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability 2026-10-02T16:29:48.706948+00:00

Affected: NuGet: System.Security.Cryptography.Xml

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A security feature bypass vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability to bypass encryption protections and access encrypted data.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/412.

## CVSS Details

- **Version:** 3.1 - **Severity:** High - **Score:** 8.1 - **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-347 (Improper Verification of Cryptographic Signature)

## Affected Platforms

- **Platforms:** All - **Architectures:** All

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

### <a name=".NET 10.0"></a>.NET 10.0 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Xml](https://www.nuget.org/packages/System.Security.Cryptography.Xml) | >= 10.0.0, <= 10.0.9 | 10.0.10

### <a name=".NET 9.0"></a>.NET 9.0 Package name | Affected version | Patched version ------------…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-47304 msrc_CVE-2026-47304 — .NET Security Feature Bypass Vulnerability 2026-10-02T16:29:48.707006+00:00 msrc_CVE-2026-47304 https://cve.radiocsirt.org/vuln/ncsc-2026-0235 NCSC-2026-0235 — Kwetsbaarheden verholpen in Microsoft Developer Tools 2026-10-02T16:29:48.707024+00:00 NCSC-2026-0235 https://cve.radiocsirt.org/vuln/rhsa-2026:39952 RHSA-2026:39952 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T16:29:48.707066+00:00

ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass dotnet: .NET Security Feature Bypass Vulnerability .NET: .NET: Network Spoofing Vulnerability ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

 https://cve.radiocsirt.org/vuln/rhsa-2026:41893 RHSA-2026:41893 — Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update 2026-10-02T16:29:48.707090+00:00

ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass dotnet: .NET Security Feature Bypass Vulnerability dotnet: .NET Framework: Denial of Service via improper input validation dotnet: .NET: Denial of Service due to uncontrolled resource allocation dotnet: .NET: Local tampering via improper link resolution dotnet: .NET Framework: Denial of Service via network-based buffer overflow dotnet: .NET: Security feature bypass due to incorrect authorization dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation dotnet: .NET: Local code execution via deserialization of untrusted data dotnet: .NET Framework: Privilege escalation via code injection dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM .NET: .NET: Network Spoofing Vulnerability ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation dotnet: .NET Core: Denial of Service via type confusion

 https://cve.radiocsirt.org/vuln/rlsa-2026:41893 RLSA-2026:41893 — Important: .NET 8.0 security, bug fix, and enhancement update 2026-10-02T16:29:48.707130+00:00

Affected: Rocky Linux:10: dotnet8.0

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET: Denial of Service due to uncontrolled resource allocation (C…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-47304 UBUNTU-CVE-2026-47304 2026-10-02T16:29:48.707172+00:00

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:26.04:LTS: dotnet10

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2324 WID-SEC-W-2026-2324 — Microsoft DeveloperTools: Mehrere Schwachstellen 2026-10-02T16:29:48.707198+00:00

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, .NET Framework, Microsoft .NET, Visual Studio 2022 und Visual Studio 2026 ausnutzen, um erweiterte Berechtigungen, einschließlich Administratorrechte, zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen, einen Denial-of-Service-Zustand auszulösen oder Spoofing-Angriffe durchzuführen.