BaselineWatch
58264 CVEs · 127 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,264 New, 24 h1,112 Changed, 24 h2,101 In KEV127 Public exploit1,578 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2025-55315exploit ×8 9.9 critical 67.0% microsoft, asp.net_core, visual_studio_2022 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. 18 Oct
CVE-2026-96230exploit 8.8 high 1.0% no CPE yet Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. Thu 22 Oct
CVE-2026-40372 9.1 critical 11.0% microsoft, asp.net_core Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. Mon 26 Oct
CVE-2026-42899 7.5 high 2.0% microsoft, .net Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network. Mon 26 Oct
CVE-2026-88092 9.4 critical 1.0% microsoft, asp.net_core, visual_studio_2022, visual_studio_2026 Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. 16 Oct
CVE-2026-70188 9.1 critical 1.0% no CPE yet Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. 19 Oct
CVE-2026-47303 8.8 high 1.0% microsoft, .net, visual_studio_2022, visual_studio_2026 Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. 18 h ago
CVE-2026-47300 8.8 high 1.0% microsoft, .net, visual_studio_2022, visual_studio_2026 Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. 18 h ago
CVE-2026-102870 8.8 high 1.0% no CPE yet Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. Sun 25 Oct
CVE-2026-70175 8.1 high 1.0% no CPE yet Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. 19 Oct
CVE-2026-56170 7.5 high 1.0% microsoft, .net Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. 18 h ago
CVE-2026-45646 7.5 high 1.0% microsoft, aspnet.odata, aspnetcore.odata Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. 18 h ago
CVE-2026-50506 7.5 high 1.0% microsoft, aspnet.odata, aspnetcore.odata Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. 18 h ago
CVE-2026-96233 7.5 high 1.0% no CPE yet Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. Thu 22 Oct
CVE-2026-70179 7.5 high 1.0% no CPE yet Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. Thu 22 Oct
CVE-2026-70159 7.5 high 1.0% no CPE yet Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Thu 22 Oct
CVE-2026-109468 7.5 high 1.0% no CPE yet Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Thu 22 Oct
CVE-2026-96236 7.5 high 1.0% no CPE yet Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. 19 Oct
CVE-2026-70183 7.5 high 1.0% no CPE yet Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network. 19 Oct
CVE-2026-70181 7.5 high 1.0% no CPE yet Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. 19 Oct
CVE-2026-70186 7.5 high 1.0% no CPE yet Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. 19 Oct
CVE-2026-70196 5.9 medium 1.0% no CPE yet Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. 19 Oct
CVE-2026-92707 5.3 medium 1.0% no CPE yet MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9. 16 Oct

23 of 23

Download these 23 as CSV · subscribe to this list.

EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.