Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-50649 | 7.8 high | 4.0% | microsoft, .net_framework, .net, visual_studio_2026 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. | 15 h ago |
| CVE-2026-50646 | 7.8 high | 4.0% | microsoft, .net_framework, .net, visual_studio_2022 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. | 15 h ago |
| CVE-2026-50652 | 7.5 high | 2.0% | microsoft, azure active directory, microsoft .net framework 3.5, microsoft .net framework 3.5 and 4.7.2 | Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-62872 | 8.8 high | 1.0% | microsoft, microsoft .net framework 3.5, microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2, microsoft .net framework 3.5 and 4.7.2 | Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network. | 15 h ago |
| CVE-2026-69522 | 8.8 high | 1.0% | microsoft, .net 10.0, .net 11.0, .net 8.0 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-85363 | 8.8 high | 1.0% | no CPE yet | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network. | Thu 22 Oct |
| CVE-2026-70035 | 8.8 high | 1.0% | no CPE yet | Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. | Thu 22 Oct |
| CVE-2026-70007 | 8.8 high | 1.0% | no CPE yet | Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network. | Thu 22 Oct |
| CVE-2026-108398 | 8.8 high | 1.0% | no CPE yet | Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. | 19 Oct |
| CVE-2026-50648 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50527 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50525 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50524 | 7.5 high | 1.0% | microsoft, .net, visual_studio_2022, visual_studio_2026 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-47302 | 7.5 high | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50647 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50411 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50355 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50368 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50304 | 7.5 high | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-50653 | 7.5 high | 1.0% | microsoft, azure active directory, microsoft .net framework 3.5, microsoft .net framework 3.5 and 4.7.2 | Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-23666 | 7.5 high | 1.0% | microsoft, .net_framework | Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network. | Mon 26 Oct |
| CVE-2026-96960 | 7.5 high | 1.0% | microsoft, .net, .net_framework | Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. | Thu 22 Oct |
| CVE-2026-96959 | 7.5 high | 1.0% | microsoft, .net, .net_framework | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | Thu 22 Oct |
| CVE-2026-96958 | 7.5 high | 1.0% | microsoft, .net, .net_framework | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | Thu 22 Oct |
| CVE-2026-97801 | 7.5 high | 1.0% | no CPE yet | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network. | 19 Oct |
| CVE-2026-97788 | 7.5 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. | 16 Oct |
| CVE-2026-96222 | 7.4 high | 1.0% | microsoft, windows_10_1607, windows_10_1809, windows_server_2012 | Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | Thu 22 Oct |
| CVE-2026-35433 | 7.3 high | 1.0% | microsoft, .net_framework, .net | Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-50659 | 6.5 medium | 1.0% | microsoft, .net_framework, .net, visual_studio_2022 | Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. | 15 h ago |
| CVE-2026-50324 | 5.9 medium | 1.0% | microsoft, microsoft .net framework 3.5 and 4.7.2, microsoft .net framework 3.5 and 4.8, microsoft .net framework 3.5 and 4.8.1 | Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. | 15 h ago |
| CVE-2026-105242 | 5.3 medium | 1.0% | apache, log4net | Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected. This issue affects Apache log4net: from 1.2.11 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue. | 9 Oct |
| CVE-2026-47304 | 9.8 critical | 0.00% | microsoft, .net_framework, .net, visual_studio_2017 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. | 15 h ago |
| CVE-2026-70354 | 7.8 high | 0.00% | microsoft, visual_studio_2022, visual_studio_2026, .net_framework | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. | 14 h ago |
| CVE-2026-50650 | 7.8 high | 0.00% | microsoft, .net_framework, .net | Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. | 15 h ago |
| CVE-2026-65810 | 7.8 high | 0.00% | microsoft, microsoft .net framework 3.5, microsoft .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2, microsoft .net framework 3.5 and 4.7.2 | Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally. | 15 h ago |
| CVE-2023-37524 | 7.8 high | 0.00% | hcltech, traveler_for_microsoft_outlook | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components. | 16 h ago |
| CVE-2026-62897 | 7.0 high | 0.00% | microsoft, .net_framework, visual_studio_2022, visual_studio_2026 | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally. | 15 h ago |
| CVE-2026-70194 | 6.5 medium | 0.00% | no CPE yet | Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. | Thu 22 Oct |
| CVE-2026-108569 | 2.1 low | 0.00% | no CPE yet | A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | 14 Oct |
| CVE-2026-108570 | 2.1 low | 0.00% | no CPE yet | A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | 13 Oct |
40 of 40
Download these 40 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.