SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.
CVE-2026-53466 is a medium severity vulnerability in the ImageMagick XCF image decoder where an integer overflow leads to a heap buffer over-read. This occurs when processing a crafted image, potentially causing a crash. The flaw affects Magick.NET-Q16-AnyCPU versions prior to 14.15.0 and is fixed in version 14.15.0.
An elevation of privilege vulnerability exists in Windows Presentation Foundation (WPF) in Microsoft .NET 8, 9, and 10 when parsing specially crafted XAML input. This vulnerability could allow an attacker to elevate privileges on the affected system. The issue is due to improper control of code generation (CWE-94). Affected package versions have been identified and patched in newer releases.
A denial of service vulnerability exists in the .NET HTTP client (System.Net.Http) affecting .NET versions 8, 9, and 10. The flaw allows an attacker to exploit the HTTP/2 protocol to cause an out-of-memory condition, leading to service disruption. This vulnerability is identified as CWE-770, involving allocation of resources without limits or throttling. Microsoft has released patches for affected versions to address this issue.
A denial of service vulnerability exists in Microsoft .NET TLS/SSL (System.Net.Security) affecting .NET versions 8, 9, and 10. An attacker can send a malformed TLS handshake request causing the application to crash or become unresponsive. This vulnerability is tracked as CVE-2026-50524 and has a CVSS 3.1 score of 7.5 (high severity).
A denial of service vulnerability exists in the .NET runtime cryptography layer affecting .NET 8, 9, and 10 on Linux and macOS platforms. The flaw occurs when parsing specially crafted X.509 certificates, potentially causing the application to crash or become unresponsive. This vulnerability is identified as CWE-843 (Access of Resource Using Incompatible Type).
Datadog's dd-trace-dotnet library versions prior to 3.43.0 improperly parse W3C baggage HTTP headers without enforcing limits on the number or size of items during extraction. This allows a remote unauthenticated attacker to send requests with excessively large or numerous baggage items, causing unbounded CPU and memory consumption. This can lead to a denial of service (DoS) on any HTTP service using the affected tracer with baggage propagation enabled by default.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.29.1 and 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.29.1 and 1.32.5.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a developer or CI host. This issue is fixed in version 1.29.1 and 1.32.5.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.29.1 and 1.32.4.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were imported. This issue is fixed in version 1.29.1 and 1.32.0.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLiteral() in Writers/StringExtensions.cs into Ruby double-quoted literals without escaping #, allowing attacker-controlled #{expr}, #$var, or #@var interpolation markers to inject arbitrary Ruby code into generated model classes. This issue is fixed in version 1.29.1 and 1.32.0.
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients. This issue is fixed in version 1.29.1 and 1.32.3.
The vspropertypages NuGet package version 99.99.99 contains malicious code as identified by the OpenSSF malicious packages database. This is a supply chain threat involving a package that could potentially harm users who consume it. No specific technical details or exploitation methods are provided. There is no CVSS score or vendor patch information available.
The NuGet package 'security_hacks' version 9999.0.0 is identified as containing malicious code. This package is flagged as a malicious package by the OpenSSF and listed in the GHSA malware database. No specific technical details about the malicious behavior or exploitation methods are provided.
The hackney.core.enums NuGet package version 99.99.99 contains malicious code as identified by the OpenSSF malicious packages database. This is a supply chain threat involving a malicious package published to the NuGet ecosystem. No CVSS score or detailed technical exploitation information is provided.
The hackney.core.jwt package on NuGet has been identified as containing malicious code. This is a supply chain threat where the package itself is intentionally harmful. There is no CVSS score or detailed technical vulnerability information available. No known exploits in the wild have been reported. The affected version is exactly 99.99.99, which appears to be a placeholder or non-standard version identifier.