Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
202 results · page 1 of 5
Oct 13, 2026Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.CVE-2026-97801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.CVE-2026-97788 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96960 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96959 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96958 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-96222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.CVE-2026-85363 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-84008 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-70194 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
- Product
- .NET 11.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.CVE-2026-70035 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.CVE-2026-70007 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.CVE-2026-108398 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
- Product
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2026-102869 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95.CVE-2026-108570 · Other software · Furion · reported by VulDBLow 2.1
A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- .NET Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026A vulnerability was identified in Furion .NET Framework up to 4.9.9.92.CVE-2026-108569 · Other software · Furion · reported by VulDBLow 2.1
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- .NET Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.CVE-2026-65810 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.CVE-2026-62897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.CVE-2026-62886 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.CVE-2026-62872 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.CVE-2026-50650 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
- Product
- .NET 8.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-50648 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.CVE-2026-50646 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
- Product
- .NET 8.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-50527 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-50524 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a neCVE-2026-50647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.CVE-2026-50411 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.CVE-2026-50368 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.CVE-2026-50355 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a neCVE-2026-50324 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.CVE-2026-50304 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5 AND 4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service.CVE-2023-37524 · Other software · HCLSoftware · reported by psirt@hcl.comHigh 7.7
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components.
- Product
- Traveler for Microsoft Outlook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Apr 14, 2026Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.CVE-2026-33116 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
- Product
- .NET 10.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
Apr 14, 2026Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service ovCVE-2026-32226 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-23666 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
- Product
- Microsoft .NET Framework 3.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comaccess.redhat.com
Oct 14, 2025Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.CVE-2025-55248 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive CVE-2025-0556 · Other software · Progress Software · reported by security@progress.comHigh 8.8
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityCVE-2025-21176 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comherodevs.com
Oct 8, 2024.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2024-43484 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comsecurity.netapp.com
Oct 8, 2024.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2024-43483 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityCVE-2024-38081 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 8, 2024NHibernate is an object-relational mapper for the .NET framework.CVE-2024-39677 · Other software · nhibernate · reported by GitHubMedium 5.9
NHibernate is an object-relational mapper for the .NET framework. A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes mappings using inheritance with discriminator values; HQL queries referencing a static field of the application; users of the SqlInsertBuilder and SqlUpdateBuilder utilities, calling their AddColumn overload taking a literal value; and any direct use of the ObjectToSQLString methods for building SQL queries on the user side. This vulnerability is fixed in 5.4.9 and 5.5.2.
- Product
- nhibernate-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024.NET, .NET Framework, and Visual Studio Remote Code Execution VulnerabilityCVE-2024-21409 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 22, 2024Microsoft .NET Framework Information Disclosure VulnerabilityCVE-2024-29059 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
- Product
- .NET Framework
- On CISA’s list since
- Feb 4, 2025 (federal fix deadline Feb 25, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Jan 9, 2024.NET Framework Denial of Service VulnerabilityCVE-2024-21312 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET Framework Denial of Service Vulnerability
- Product
- Microsoft .NET Framework 3.5 AND 4.8.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 9, 2024NET, .NET Framework, and Visual Studio Security Feature Bypass VulnerabilityCVE-2024-0057 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityCVE-2023-36049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023ASP.NET Security Feature Bypass VulnerabilityCVE-2023-36560 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
ASP.NET Security Feature Bypass Vulnerability
- Product
- Microsoft .NET Framework 3.5 AND 4.8.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2023.NET Framework Remote Code Execution VulnerabilityCVE-2023-36788 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
.NET Framework Remote Code Execution Vulnerability
- Product
- Microsoft .NET Framework 3.5 AND 4.8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023ASP.NET Elevation of Privilege VulnerabilityCVE-2023-36899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
ASP.NET Elevation of Privilege Vulnerability
- Product
- Microsoft .NET Framework 2.0 Service Pack 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023.NET Framework Spoofing VulnerabilityCVE-2023-36873 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
.NET Framework Spoofing Vulnerability
- Product
- Microsoft .NET Framework 3.5 and 4.6.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.