vuln-osv update 2026-11-11T00:44:13Z

data/NuGet/GHSA-49q5-vjx7-5gwr.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-49q5-vjx7-5gwr","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:15:03.501127686Z","withdrawn":"2026-11-10T22:07:38Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references.\n\n## Original Description\nUncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.Server.HttpSys","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.HttpSys"},"versions":["2.3.10"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-49q5-vjx7-5gwr/GHSA-49q5-vjx7-5gwr.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114154"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:07:38Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}

data/NuGet/GHSA-95x6-7hq8-2c37.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-95x6-7hq8-2c37","published":"2026-11-10T21:32:52Z","modified":"2026-11-10T22:30:03.785251805Z","withdrawn":"2026-11-10T22:16:47Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references.\n\n## Original Description\nConcurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-95x6-7hq8-2c37/GHSA-95x6-7hq8-2c37.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114157"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114157"}],"database_specific":{"cwe_ids":["CWE-362"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:16:47Z","nvd_published_at":"2026-11-10T19:19:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"}]}

data/NuGet/GHSA-c827-j3xf-67v6.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-c827-j3xf-67v6","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:30:03.730169787Z","withdrawn":"2026-11-10T22:14:43Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114156 - ASP.NET Core Security Feature Bypass Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-8w29-6cjc-h6w4. This link is maintained to preserve external references.\n\n## Original Description\nImproper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.7.26381.103"},{"last_affected":"11.0.0-rc.3.26522.148"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-c827-j3xf-67v6/GHSA-c827-j3xf-67v6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114156"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114156"}],"database_specific":{"cwe_ids":["CWE-41"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:14:43Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"}]}

data/NuGet/GHSA-fgfw-85w4-gx99.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-fgfw-85w4-gx99","published":"2026-11-10T21:33:44Z","modified":"2026-11-10T22:45:03.444752861Z","withdrawn":"2026-11-10T22:30:50Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references.\n\n## Original Description\nInsertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120792"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120792"}],"database_specific":{"cwe_ids":["CWE-532"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:30:50Z","nvd_published_at":"2026-11-10T19:20:28Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L"}]}

data/NuGet/GHSA-gxg8-5rwf-cg43.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-gxg8-5rwf-cg43","published":"2026-11-10T21:32:51Z","modified":"2026-11-10T22:15:04.366637508Z","withdrawn":"2026-11-10T22:06:12Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114147 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references.\n\n## Original Description\nMissing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.SignalR.StackExchangeRedis","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.SignalR.StackExchangeRedis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-gxg8-5rwf-cg43/GHSA-gxg8-5rwf-cg43.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114147"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114147"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:06:12Z","nvd_published_at":"2026-11-10T19:19:07Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}

data/NuGet/GHSA-hfpm-4fc4-g2wc.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-hfpm-4fc4-g2wc","published":"2026-11-10T21:33:43Z","modified":"2026-11-10T22:30:03.447265936Z","withdrawn":"2026-11-10T22:17:41Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.\n\n## Original Description\nCreation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5"],"database_specific":{"last_known_affected_version_range":"< 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778"}],"database_specific":{"cwe_ids":["CWE-379"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T22:17:41Z","nvd_published_at":"2026-11-10T19:20:26Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}

data/NuGet/GHSA-r33q-3g5w-gqx6.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-r33q-3g5w-gqx6","published":"2026-11-10T21:32:22Z","modified":"2026-11-11T00:30:04.459937050Z","withdrawn":"2026-11-11T00:11:54Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-6856-87hx-p5x7. This link is maintained to preserve external references.\n\n## Original Description\nImproper access control in .NET allows an authorized attacker to elevate privileges locally.","affected":[{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.2.0-preview-20220301-01"}]}],"versions":["17.10.0","17.10.0-preview-24080-01","17.10.0-release-24177-07","17.11.0","17.11.0-release-24352-06","17.11.0-release-24373-02","17.11.1","17.11.2","17.12.0","17.12.1","17.13.0","17.14.0","17.14.0-preview-25107-01","17.14.1","17.14.2","17.2.0","17.2.0-preview-20220301-01","17.2.0-preview-20220401-07","17.2.0-preview-20220401-08","17.2.1","17.3.0","17.3.0-preview-20220426-02","17.3.0-preview-20220530-08","17.3.0-preview-20220612-01","17.3.1","17.3.2","17.3.3","17.3.4","17.4.0","17.4.0-preview-20220707-01","17.4.0-preview-20220726-02","17.4.0-preview-20221003-03","17.4.0-release-20220926-01","17.4.1","17.5.0","17.5.0-preview-20221003-04","17.5.0-preview-20221221-03","17.6.0","17.6.0-preview-20230223-05","17.6.1","17.6.2","17.6.3","17.7.0","17.7.0-preview-23364-03","17.7.1","17.7.2","17.8.0","17.8.0-preview-23371-04","17.8.0-preview-23424-02","17.8.0-release-23468-02","17.8.1","17.9.0","17.9.0-preview-23503-02","17.9.0-preview-23531-01","17.9.0-preview-23577-04","17.9.0-release-23619-01","18.0.0","18.0.1","18.0.2","18.10.0","18.10.1","18.10.2","18.11.0","18.11.1","18.3.0","18.4.0","18.5.0","18.5.1","18.6.0","18.7.0","18.7.1","18.8.0","18.8.1","18.9.0"],"database_specific":{"last_known_affected_version_range":"< 17.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r33q-3g5w-gqx6/GHSA-r33q-3g5w-gqx6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105544"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105544"}],"database_specific":{"cwe_ids":[],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:11:54Z","nvd_published_at":"2026-11-10T19:17:56Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"}]}

data/NuGet/GHSA-wrm2-c2h2-4w82.json

@@ -0,0 +1 @@
+{"schema_version":"1.9.2","id":"GHSA-wrm2-c2h2-4w82","published":"2026-11-10T21:32:29Z","modified":"2026-11-11T00:30:04.347303079Z","withdrawn":"2026-11-11T00:21:09Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-109478 - ASP.NET Core Denial of Service Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r3qf-p3jm-8h4p. This link is maintained to preserve external references.\n\n## Original Description\nInefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.","affected":[{"package":{"name":"Microsoft.AspNetCore.App.Runtime.linux-arm","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.linux-arm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-preview.1.23112.2"},{"last_affected":"8.0.33"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-wrm2-c2h2-4w82/GHSA-wrm2-c2h2-4w82.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109478"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109478"}],"database_specific":{"cwe_ids":["CWE-407"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:21:09Z","nvd_published_at":"2026-11-10T19:18:17Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}