A critical elevation of privilege vulnerability (CVE-2026-114146) exists in Microsoft.AspNetCore.Http.Connections, part of ASP.NET Core. The flaw allows SignalR connections to not consistently bind to the identity negotiated at connection establishment, enabling injected messages to execute Hub invocations as the victim. This affects multiple platforms including Windows, Linux, and macOS across various runtime and standalone package versions. Microsoft has released patches for affected versions to address this issue.
A vulnerability in ASP.NET Core's ResponseBufferingStream can cause response-body data from one request to be exposed in HTTP logging of another request due to reused pooled tail memory. This affects multiple platforms and architectures. The issue is addressed in version 11.0.0 of the affected runtime packages.
Multiple security vulnerabilities have been identified in libreswan, an implementation of IPsec and IKE for Linux used to build secure VPN tunnels. These include use-after-free, denial of service via malformed X.509 certificates, and null pointer dereferences in various IKEv2 components. Red Hat has issued an important security advisory providing fixes and enhancements by rebasing libreswan to version 5.3.3. The update addresses four specific CVEs related to memory corruption and denial of service issues.
A high-severity vulnerability (CVE-2026-118748) affects ASP.NET Core versions 11.0.0-preview.7.26381.103 through 11.0.0-rc.3.26522.148 across multiple platforms and architectures. The flaw involves Blazor static-SSR client validation retaining attacker-controlled rendered field names in an unbounded singleton cache, which can lead to remote process memory exhaustion, causing denial of service. A fixed version 11.0.0 is available and should be applied to mitigate the issue.
A vulnerability in the .NET SDK's dotnet-watch component allows a local attacker to elevate privileges by replacing or modifying temporary solution files used during builds. The issue affects Linux and macOS platforms with certain versions of the .NET SDK and the Microsoft.DotNet.HotReload.Watch.Aspire package. Microsoft has released fixed versions that store generated solution files in a private temporary directory and keep files open with read-only sharing during builds to prevent tampering.
A vulnerability in Ruby on Rails Active Storage prior to versions 8.0.5.2 and between 8.1 and 8.1.4.1 allows exposure of local media files. This occurs because certain Active Storage components pass uploaded blob contents to FFmpeg without restricting the demuxer, enabling an attacker to craft uploads that cause FFmpeg to open local file segments. This can disclose local files readable by the application process if the attacker knows the file path.
A high-severity elevation of privilege vulnerability exists in ASP.NET Core affecting the Blazor/SignalR `/_blazor/refresh` path. This flaw allows a cross-site request to bind a victim's authenticated principal to an attacker-owned circuit, potentially leading to unauthorized access. The issue affects multiple platforms including Windows, Linux, and macOS across all architectures. Versions from 11.0.0-preview.6.26359.118 up to and including 11.0.0-rc.3.26522.148 are vulnerable. A fixed version 11.0.0 has been released to address this vulnerability.
A denial of service vulnerability exists in Microsoft.AspNetCore.WebUtilities versions 2.3.0 through 2.3.13. The issue arises from the FileBufferingReadStream buffer allocation, which can allow unauthenticated multipart-form requests to exhaust memory. This vulnerability has a CVSS 3.1 base score of 7.5 (high severity). A fixed version 2.3.14 is available to address this issue.
A vulnerability in Aspire.Hosting.AppHost prior to version 13.6.5 allows an attacker-controlled container to replay an authenticated Aspire Dashboard session cookie, potentially enabling code execution as the host developer. This affects macOS platforms on x64 and Arm64 architectures. The issue arises when an authenticated AppHost workflow routes to a linked HTTPS YARP gateway controlled by an attacker. A fix is available in version 13.6.5.
A denial of service vulnerability exists in the managed HttpListener component of Microsoft .NET on Linux and macOS platforms. The flaw allows recursive processing of an unterminated HTTP request line, which can exhaust the process stack and cause a denial of service. This affects multiple runtime packages across .NET versions 8.0 through 11.0.0 preview. Fixed versions have been released to address this issue.
A vulnerability in .NET runtime versions from 11.0.0-preview.1.26104.118 up to 11.0.0-rc.3.26522.148 allows an unauthorized attacker to cause a denial of service via inefficient algorithmic complexity. This affects multiple platforms including Windows, Linux, and macOS across various architectures. The issue is tracked as CVE-2026-120796 and has a medium severity with a CVSS score of 5.3. Fixed versions are available starting from 11.0.0.
A denial of service vulnerability exists in the System.Formats.Cbor NuGet package used in .NET. The issue arises from colliding CBOR map keys that can cause hash-flooding in uniqueness checks. This vulnerability affects multiple package versions across the 8.0, 9.0, 10.0, and 11.0 series. Microsoft has released patched versions to address this by implementing seeded Marvin hashing to mitigate the hash collision attack.
A vulnerability in ASP.NET Core's minimal API validation causes repeated copying of a growing validation-error dictionary, enabling attacker-controlled collections to trigger excessive CPU usage after client disconnection. This results in a denial-of-service condition. The issue affects multiple platforms and architectures and is fixed in version 11.0.0 of the affected packages.
A high-severity vulnerability in ASP.NET Core allows multipart form processing to bypass the configured header-count limit, leading to excessive resource consumption and potential denial of service. This affects multiple platforms and architectures, including Windows, Linux, and macOS. Fixed versions have been released for .NET 8.0, 9.0, 10.0, and 11.0 runtime packages.
A vulnerability in ASP.NET Core allows injection of cookie path delimiters via a crafted X-Forwarded-Prefix header unless PathBase-derived cookie paths percent-encode semicolons. This affects multiple runtime packages across Windows, Linux, and macOS platforms on various architectures. The issue is tracked as CVE-2026-109476 with a CVSS 3.1 base score of 6.1 (medium severity). Fixed versions have been released for affected packages.
Microsoft Research has identified a threat where AI agent models can be backdoored by modifying fewer than 10 neurons to embed a sleeper agent payload. This backdoored model passes normal evaluations but executes attacker commands when triggered by a specific string. The threat is significant because AI agents often run unattended with privileged access, making model weight integrity critical. Microsoft has not observed this technique used in the wild but recommends auditing model weights, using AI auditors, securing model hubs, and applying runtime protections to mitigate risk.
The npm package 'baidu-ti' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
A critical remote code execution vulnerability exists in React Server Components affecting react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0. The flaw can be exploited via crafted payloads involving multiple typed arrays and attacker-controlled values. Fixed versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1 have been released and immediate upgrading is recommended. Applications not using React Server Components or the affected frameworks are not impacted.
CVE-2026-20183 is a medium severity vulnerability in Cisco Identity Services Engine (ISE) software versions 3.1.0 through 3.5.0. It allows an authenticated attacker with Administrator credentials to modify certain configuration elements due to improper server-side authorization validation in the web management interface.