Threat Intelligence Database

CVE-2026-69806 is a high-severity vulnerability in Microsoft .NET 10.0 that allows exposure of sensitive information to unauthorized actors. This flaw enables an authorized attacker with local access to elevate their privileges. The vulnerability affects multiple versions of .NET, including 9.0.x, 10.0.x, 11.0.0, 17.14.x, and 18.9.x. An official fix is available from Microsoft to address this issue.

CVE-2026-71328 is a heap-based buffer overflow vulnerability in Microsoft .NET 10.0 and related versions. It allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. An official fix is available from Microsoft.

CVE-2026-69304 is a medium severity vulnerability in Microsoft .NET affecting ASP.NET Core. It involves improper handling of highly compressed data, leading to data amplification that can be exploited by an unauthorized attacker to cause a denial of service (DoS) over a network. The vulnerability affects multiple .NET versions prior to their respective fixed releases. An official fix is available from Microsoft.

CVE-2026-69439 is a heap-based buffer overflow vulnerability in Microsoft .NET 10.0 and related versions that allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a high severity with a CVSS score of 8.8. An official fix is available from Microsoft to address this issue.

CVE-2026-69522 is a heap-based buffer overflow vulnerability in Microsoft .NET 10.0 and several other versions. It allows an unauthorized attacker to execute code remotely over a network. The vulnerability has a high severity with a CVSS score of 8.8. An official fix is available from Microsoft.

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.