Most recent entries from all

bdu:2026-01775

BELL-CVE-2026-21218

Affected: Alpaquita:25: dotnet8-runtime, Alpaquita:25: dotnet8-sdk, Alpaquita:stream: dotnet8-runtime, Alpaquita:stream: dotnet8-sdk

BIT-dotnet-2026-21218 — .NET Spoofing Vulnerability

Affected: Bitnami: dotnet

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

certfr-2026-avi-0150 — De multiples vulnérabilités ont été découvertes dans Microsoft Windows. Certaines d'entre elles permettent à un attaqua…

certfr-2026-avi-0150

EUVD-2026-355640

fkie_cve-2026-21218

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

GHSA-qvhc-9v3j-5rfw — Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability

Affected: NuGet: System.Security.Cryptography.Cose

# Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability

## <a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An attacker could exploit this vulnerability by crafting a malicious payload that bypasses the security checks in the affected System.Security.Cryptography.Cose versions, potentially leading to unauthorized access or data manipulation.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/380

## <a name="mitigation-factors"></a>Mitigation factors

If your application does not use System.Security.Cryptography.Cose it is not affected. By default, no .NET applications reference this component.

## <a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET project if it uses any of affected packages versions listed below

### <a name=".NET 10"></a>.NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [System.Security.Cryptography.Cose](https://www.nuget.org/packages/System.Security.Cryptography.Cose) | >= 10.0.0, <= 10.0.2 | 10.0.3

### <a name=".NET 9"></a>.NET 9 Package name | Affected version | Patched version ---------…

msrc_CVE-2026-21218 — .NET Spoofing Vulnerability

msrc_CVE-2026-21218

NCSC-2026-0056 — Kwetsbaarheden verholpen in Microsoft Developer Tools

NCSC-2026-0056

UBUNTU-CVE-2026-21218

Affected: Ubuntu:22.04:LTS: dotnet6, Ubuntu:22.04:LTS: dotnet7, Ubuntu:22.04:LTS: dotnet8, Ubuntu:24.04:LTS: dotnet10, Ubuntu:24.04:LTS: dotnet8, Ubuntu:25.10: dotnet10, Ubuntu:25.10: dotnet8, Ubuntu:25.10: dotnet9

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

VDE-2026-064 — METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases.

Notice: LabX Standard was formerly known as LabX Cloud Local.

WID-SEC-W-2026-0367 — Microsoft DeveloperTools (Visual Studio Code und .NET): Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Visual Studio Code und .NET ausnutzen, um sich erhöhte Rechte zu verschaffen, beliebigen Code auszuführen, Spoofing-Angriffe zu starten und die Authentifizierung zu umgehen.