NCSC-2026-0426
Vulnerability from csaf_ncscnl - Published: 2026-10-13 18:56 - Updated: 2026-10-13 18:56Summary
Kwetsbaarheden verholpen in Microsoft Developer Tools
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Microsoft heeft kwetsbaarheden verholpen in diverse componenten van de Developer Tools, zoals .NET en Visual Studio.
Interpretaties: Een kwaadwillende kan aanvallen uitvoeren die kunnen leiden tot de categoriën schade zoals weergegeven in de onderstaande tabellen.
.NET:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-58280 | 7.50 | Denial-of-Service |
| CVE-2026-66822 | 5.90 | Toegang tot gevoelige gegevens |
| CVE-2026-69651 | 7.50 | Denial-of-Service |
| CVE-2026-70161 | 7.30 | Verkrijgen van verhoogde rechten |
| CVE-2026-70165 | 6.70 | Verkrijgen van verhoogde rechten |
| CVE-2026-70174 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70190 | 7.30 | Verkrijgen van verhoogde rechten |
| CVE-2026-70197 | 8.10 | Uitvoeren van willekeurige code |
| CVE-2026-83520 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-84008 | 7.50 | Denial-of-Service |
| CVE-2026-87697 | 8.80 | Uitvoeren van willekeurige code, <Vertaal: > |
| CVE-2026-96224 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-96225 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-96229 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-96231 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-96232 | 7.50 | Toegang tot gevoelige gegevens |
| CVE-2026-96234 | 5.30 | Toegang tot gevoelige gegevens |
| CVE-2026-96235 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-96237 | 7.50 | Uitvoeren van willekeurige code |
| CVE-2026-96238 | 6.50 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-96957 | 8.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-96958 | 7.50 | Denial-of-Service |
| CVE-2026-96959 | 7.50 | Denial-of-Service |
| CVE-2026-96960 | 7.50 | Denial-of-Service |
|------------------|------|-------------------------------------|
Visual Studio Code:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102229 | 6.80 | Toegang tot gevoelige gegevens |
| CVE-2026-102230 | 7.40 | Toegang tot gevoelige gegevens |
| CVE-2026-102231 | 7.70 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102232 | 7.00 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102233 | 7.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102234 | 7.40 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102235 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-102238 | 9.60 | Uitvoeren van willekeurige code |
| CVE-2026-102851 | 6.10 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-69370 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70098 | 8.80 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|
ASP.NET Core:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102870 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70159 | 7.50 | Denial-of-Service |
| CVE-2026-70175 | 8.10 | Verkrijgen van verhoogde rechten |
| CVE-2026-70179 | 7.50 | Verkrijgen van verhoogde rechten |
| CVE-2026-70181 | 7.50 | Denial-of-Service |
| CVE-2026-70183 | 7.50 | Verkrijgen van verhoogde rechten |
| CVE-2026-70186 | 7.50 | Denial-of-Service |
| CVE-2026-70188 | 9.10 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-70196 | 5.90 | Denial-of-Service |
| CVE-2026-88092 | 9.40 | <Vertaal: Tampering> |
| CVE-2026-96230 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-96233 | 7.50 | Denial-of-Service |
| CVE-2026-96236 | 7.50 | Denial-of-Service |
|------------------|------|-------------------------------------|
Visual Studio Tools for Applications and SQL Server Management Studio:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-103572 | 8.80 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|
Windows AppX Deployment Extensions:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-69945 | 8.80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
.NET Framework:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-108398 | 8.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-70007 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70035 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70194 | 6.50 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-85363 | 8.80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
Windows AppX Deployment Service:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-69905 | 5.50 | <Vertaal: Tampering> |
| CVE-2026-69914 | 5.50 | Toegang tot gevoelige gegevens |
| CVE-2026-69969 | 4.70 | Toegang tot gevoelige gegevens |
| CVE-2026-69979 | 5.50 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-85849 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-85934 | 7.00 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
.NET and Visual Studio:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102869 | 8.80 | Verkrijgen van verhoogde rechten, <Vertaal: > |
|------------------|------|-------------------------------------|
Oplossingen: Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
https://portal.msrc.microsoft.com/en-us/security-guidance
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-41: Improper Resolution of Path Equivalence
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-116: Improper Encoding or Escaping of Output
CWE-125: Out-of-bounds Read
CWE-183: Permissive List of Allowed Inputs
CWE-190: Integer Overflow or Wraparound
CWE-201: Insertion of Sensitive Information Into Sent Data
CWE-266: Incorrect Privilege Assignment
CWE-290: Authentication Bypass by Spoofing
CWE-295: Improper Certificate Validation
CWE-346: Origin Validation Error
CWE-347: Improper Verification of Cryptographic Signature
CWE-358: Improperly Implemented Security Check for Standard
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-405: Asymmetric Resource Consumption (Amplification)
CWE-407: Inefficient Algorithmic Complexity
CWE-416: Use After Free
CWE-424: Improper Protection of Alternate Path
CWE-426: Untrusted Search Path
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-502: Deserialization of Untrusted Data
CWE-674: Uncontrolled Recursion
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
CWE-807: Reliance on Untrusted Inputs in a Security Decision
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CWE-833: Deadlock
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-862: Missing Authorization
CWE-863: Incorrect Authorization
Uncontrolled recursion vulnerability in .NET can be exploited by unauthorized attackers to cause denial of service over a network, impacting application availability.
Affected products
Known affected
36 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Microsoft / .NET 10.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 10.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 10.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 11.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 11.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 11.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 8.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 8.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 8.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 9.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 9.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / .NET 9.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / ASP.NET Core 10.0
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / ASP.NET Core 11.0
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / ASP.NET Core 8.0
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / ASP.NET Core 9.0
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Azure API Center
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft .NET Framework 4.8
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft Visual Studio 2022 version 17.14
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 10.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 10.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 10.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 11.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 11.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 11.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 9.0 installed on Linux
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 9.0 installed on Mac OS
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / System.Security.Cryptography.Xml on .NET 9.0 installed on Windows
|
vers:unknown/* | ||
|
vers:unknown/*
Microsoft / Visual Studio Code
|
vers:unknown/* |
A vulnerability in .NET allows insertion of sensitive information into transmitted data, potentially enabling unauthorized attackers to disclose confidential information over a network.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A vulnerability in Visual Studio Code involving improper neutralization of special elements in commands allows remote attackers to execute arbitrary code over a network.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A vulnerability in .NET involving inefficient algorithmic complexity can be exploited by unauthorized attackers to cause denial of service over a network.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A missing authorization vulnerability in the Windows AppX Deployment Service allows an authorized attacker to perform local tampering, potentially compromising system integrity.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An out-of-bounds read vulnerability in the Windows AppX Deployment Service allows an authorized local attacker to disclose sensitive information by reading memory beyond intended boundaries.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A missing authorization vulnerability in Windows AppX Deployment Extensions allows a local attacker to elevate privileges on the affected system.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An authorized attacker can exploit improper link resolution in the Windows AppX Deployment Service to locally disclose sensitive information.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An authorized attacker can locally bypass a security feature in the Windows AppX Deployment Service due to improper protection of an alternate execution path.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A remote code execution vulnerability in Microsoft .NET Framework allows attackers to execute arbitrary code by exploiting improper input validation, which is addressed by a security update.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A remote code execution vulnerability in Microsoft .NET Framework allows attackers to execute arbitrary code by exploiting improper input validation, which is addressed by a security update.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A remote code execution vulnerability in Visual Studio Code allows attackers to execute arbitrary code by tricking users into opening malicious repositories, with mitigation involving changes to environment variable handling.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A path traversal vulnerability in .NET allows an authorized attacker to escalate local privileges by improperly restricting directory pathname access.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An improper link resolution vulnerability in the .NET framework allows an authorized local attacker to elevate privileges by exploiting file access mechanisms.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A security vulnerability in .NET's standard input validation allows unauthorized remote code execution, posing significant risks to affected systems.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An open redirect vulnerability in ASP.NET Core enables attackers to redirect authenticated users to malicious sites, potentially exposing session information, and is addressed by updating the handling of open redirect requests.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An open redirect vulnerability in ASP.NET Core enables attackers to redirect authenticated users to malicious sites, potentially exposing session information, and is addressed by updating the handling of open redirect requests.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An open redirect vulnerability in ASP.NET Core enables attackers to redirect authenticated users to malicious sites, potentially exposing session information, and is addressed by updating the handling of open redirect requests.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An inconsistent interpretation of HTTP requests in ASP.NET Core allows unauthorized attackers to bypass security controls over a network, potentially compromising application security.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An improper link resolution vulnerability in the .NET framework allows an authorized local attacker to elevate privileges by exploiting file access mechanisms.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A vulnerability in Microsoft .NET Framework allows attackers to bypass security by using expired certificates, which is addressed by an update enforcing proper certificate validation.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An out-of-bounds write vulnerability in the .NET framework allows unauthorized remote attackers to execute arbitrary code over a network, posing a significant security risk.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Deserialization of untrusted data in .NET environments can allow unauthorized attackers to execute remote code, posing significant security risks.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A path traversal vulnerability in Visual Studio Code allows an authorized attacker to disclose sensitive information over a network by improperly limiting pathname access to a restricted directory.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A missing authorization vulnerability in Visual Studio Code allows unauthorized attackers to disclose sensitive information over a network, posing a significant security risk.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An improper resolution of path equivalence vulnerability in Visual Studio Code allows a local attacker to bypass security features, potentially compromising the integrity of the development environment.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An incorrect authorization vulnerability in Visual Studio Code allows a local attacker to bypass security controls, potentially compromising the integrity of the development environment.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A missing authorization vulnerability in Visual Studio Code allows a local attacker to bypass security controls, potentially leading to unauthorized actions within the application.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A vulnerability in Visual Studio Code enables unauthorized attackers to bypass security features by exploiting the application's reliance on untrusted network inputs.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A remote code execution vulnerability in Visual Studio Code allows attackers to execute arbitrary code by tricking users into opening malicious repositories, with mitigation involving changes to environment variable handling.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A remote code execution vulnerability in Visual Studio Code allows attackers to execute arbitrary code by tricking users into opening malicious repositories, with mitigation involving changes to environment variable handling.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An incorrect privilege assignment vulnerability in Visual Studio Code allows an authorized local attacker to bypass a security feature, potentially compromising the integrity of the development environment.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A remote code execution vulnerability in ASP.NET Core arises from improper source markup validation, enabling attackers to execute arbitrary code and potentially gain full system control with administrative privileges.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
Improper control of code generation in Visual Studio Tools for Applications and SQL Server Management Studio allows unauthorized remote code execution by attackers.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
An untrusted search path vulnerability in the .NET Framework allows an authorized local attacker to bypass a security feature, potentially compromising system integrity.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
A type confusion vulnerability in Microsoft .NET and Visual Studio enables unauthorized attackers to elevate privileges remotely over a network.
Affected products
Known affected
36 products, the same list as for
CVE-2026-58280
References
62 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Microsoft heeft kwetsbaarheden verholpen in diverse componenten van de Developer Tools, zoals .NET en Visual Studio.",
"title": "Feiten"
},
{
"category": "description",
"text": "Een kwaadwillende kan aanvallen uitvoeren die kunnen leiden tot de categori\u00ebn schade zoals weergegeven in de onderstaande tabellen.\n\n\n.NET: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-58280 | 7.50 | Denial-of-Service | \n| CVE-2026-66822 | 5.90 | Toegang tot gevoelige gegevens | \n| CVE-2026-69651 | 7.50 | Denial-of-Service | \n| CVE-2026-70161 | 7.30 | Verkrijgen van verhoogde rechten | \n| CVE-2026-70165 | 6.70 | Verkrijgen van verhoogde rechten | \n| CVE-2026-70174 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-70190 | 7.30 | Verkrijgen van verhoogde rechten | \n| CVE-2026-70197 | 8.10 | Uitvoeren van willekeurige code | \n| CVE-2026-83520 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-84008 | 7.50 | Denial-of-Service | \n| CVE-2026-87697 | 8.80 | Uitvoeren van willekeurige code, \u003cVertaal: \u003e | \n| CVE-2026-96224 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-96225 | 7.80 | Verkrijgen van verhoogde rechten | \n| CVE-2026-96229 | 6.50 | Toegang tot gevoelige gegevens | \n| CVE-2026-96231 | 7.80 | Verkrijgen van verhoogde rechten | \n| CVE-2026-96232 | 7.50 | Toegang tot gevoelige gegevens | \n| CVE-2026-96234 | 5.30 | Toegang tot gevoelige gegevens | \n| CVE-2026-96235 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-96237 | 7.50 | Uitvoeren van willekeurige code | \n| CVE-2026-96238 | 6.50 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-96957 | 8.80 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-96958 | 7.50 | Denial-of-Service | \n| CVE-2026-96959 | 7.50 | Denial-of-Service | \n| CVE-2026-96960 | 7.50 | Denial-of-Service | \n|------------------|------|-------------------------------------|\n\nVisual Studio Code: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-102229 | 6.80 | Toegang tot gevoelige gegevens | \n| CVE-2026-102230 | 7.40 | Toegang tot gevoelige gegevens | \n| CVE-2026-102231 | 7.70 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-102232 | 7.00 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-102233 | 7.80 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-102234 | 7.40 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-102235 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-102238 | 9.60 | Uitvoeren van willekeurige code | \n| CVE-2026-102851 | 6.10 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-69370 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-70098 | 8.80 | Uitvoeren van willekeurige code | \n|------------------|------|-------------------------------------|\n\nASP.NET Core: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-102870 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-70159 | 7.50 | Denial-of-Service | \n| CVE-2026-70175 | 8.10 | Verkrijgen van verhoogde rechten | \n| CVE-2026-70179 | 7.50 | Verkrijgen van verhoogde rechten | \n| CVE-2026-70181 | 7.50 | Denial-of-Service | \n| CVE-2026-70183 | 7.50 | Verkrijgen van verhoogde rechten | \n| CVE-2026-70186 | 7.50 | Denial-of-Service | \n| CVE-2026-70188 | 9.10 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-70196 | 5.90 | Denial-of-Service | \n| CVE-2026-88092 | 9.40 | \u003cVertaal: Tampering\u003e | \n| CVE-2026-96230 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-96233 | 7.50 | Denial-of-Service | \n| CVE-2026-96236 | 7.50 | Denial-of-Service | \n|------------------|------|-------------------------------------|\n\nVisual Studio Tools for Applications and SQL Server Management Studio: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-103572 | 8.80 | Uitvoeren van willekeurige code | \n|------------------|------|-------------------------------------|\n\nWindows AppX Deployment Extensions: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-69945 | 8.80 | Verkrijgen van verhoogde rechten | \n|------------------|------|-------------------------------------|\n\n.NET Framework: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-108398 | 8.80 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-70007 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-70035 | 8.80 | Uitvoeren van willekeurige code | \n| CVE-2026-70194 | 6.50 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-85363 | 8.80 | Verkrijgen van verhoogde rechten | \n|------------------|------|-------------------------------------|\n\nWindows AppX Deployment Service: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-69905 | 5.50 | \u003cVertaal: Tampering\u003e | \n| CVE-2026-69914 | 5.50 | Toegang tot gevoelige gegevens | \n| CVE-2026-69969 | 4.70 | Toegang tot gevoelige gegevens | \n| CVE-2026-69979 | 5.50 | Omzeilen van beveiligingsmaatregel | \n| CVE-2026-85849 | 7.80 | Verkrijgen van verhoogde rechten | \n| CVE-2026-85934 | 7.00 | Verkrijgen van verhoogde rechten | \n|------------------|------|-------------------------------------|\n\n.NET and Visual Studio: \n|------------------|------|-------------------------------------|\n| CVE-ID | CVSS | Impact |\n|------------------|------|-------------------------------------|\n| CVE-2026-102869 | 8.80 | Verkrijgen van verhoogde rechten, \u003cVertaal: \u003e | \n|------------------|------|-------------------------------------|\n",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:\n\nhttps://portal.msrc.microsoft.com/en-us/security-guidance",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Improper Resolution of Path Equivalence",
"title": "CWE-41"
},
{
"category": "general",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Improper Encoding or Escaping of Output",
"title": "CWE-116"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Permissive List of Allowed Inputs",
"title": "CWE-183"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Insertion of Sensitive Information Into Sent Data",
"title": "CWE-201"
},
{
"category": "general",
"text": "Incorrect Privilege Assignment",
"title": "CWE-266"
},
{
"category": "general",
"text": "Authentication Bypass by Spoofing",
"title": "CWE-290"
},
{
"category": "general",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "general",
"text": "Origin Validation Error",
"title": "CWE-346"
},
{
"category": "general",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "general",
"text": "Improperly Implemented Security Check for Standard",
"title": "CWE-358"
},
{
"category": "general",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "general",
"text": "Asymmetric Resource Consumption (Amplification)",
"title": "CWE-405"
},
{
"category": "general",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Improper Protection of Alternate Path",
"title": "CWE-424"
},
{
"category": "general",
"text": "Untrusted Search Path",
"title": "CWE-426"
},
{
"category": "general",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"title": "CWE-444"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Reliance on Untrusted Inputs in a Security Decision",
"title": "CWE-807"
},
{
"category": "general",
"text": "Inclusion of Functionality from Untrusted Control Sphere",
"title": "CWE-829"
},
{
"category": "general",
"text": "Deadlock",
"title": "CWE-833"
},
{
"category": "general",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Incorrect Authorization",
"title": "CWE-863"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"title": "Kwetsbaarheden verholpen in Microsoft Developer Tools",
"tracking": {
"current_release_date": "2026-10-13T18:56:15.788419Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0426",
"initial_release_date": "2026-10-13T18:56:15.788419Z",
"revision_history": [
{
"date": "2026-10-13T18:56:15.788419Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": ".NET 10.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": ".NET 10.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": ".NET 10.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": ".NET 11.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": ".NET 11.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": ".NET 11.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": ".NET 8.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": ".NET 8.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": ".NET 8.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": ".NET 9.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": ".NET 9.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": ".NET 9.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "ASP.NET Core 10.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "ASP.NET Core 11.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "ASP.NET Core 8.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "ASP.NET Core 9.0"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "Azure API Center"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-20"
}
}
],
"category": "product_name",
"name": "Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-21"
}
}
],
"category": "product_name",
"name": "Microsoft .NET Framework 4.8"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-22"
}
}
],
"category": "product_name",
"name": "Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-23"
}
}
],
"category": "product_name",
"name": "Microsoft Visual Studio 2022 version 17.14"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-24"
}
}
],
"category": "product_name",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-25"
}
}
],
"category": "product_name",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-26"
}
}
],
"category": "product_name",
"name": "Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-27"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 10.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-28"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 10.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-29"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 10.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-30"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 11.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-31"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 11.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-32"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 11.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-33"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 9.0 installed on Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-34"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 9.0 installed on Mac OS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-35"
}
}
],
"category": "product_name",
"name": "System.Security.Cryptography.Xml on .NET 9.0 installed on Windows"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-36"
}
}
],
"category": "product_name",
"name": "Visual Studio Code"
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-58280",
"notes": [
{
"category": "description",
"text": "Uncontrolled recursion vulnerability in .NET can be exploited by unauthorized attackers to cause denial of service over a network, impacting application availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-58280 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58280.json"
}
],
"title": "CVE-2026-58280"
},
{
"cve": "CVE-2026-66822",
"notes": [
{
"category": "description",
"text": "A vulnerability in .NET allows insertion of sensitive information into transmitted data, potentially enabling unauthorized attackers to disclose confidential information over a network.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-66822 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66822.json"
}
],
"title": "CVE-2026-66822"
},
{
"cve": "CVE-2026-69370",
"notes": [
{
"category": "description",
"text": "A vulnerability in Visual Studio Code involving improper neutralization of special elements in commands allows remote attackers to execute arbitrary code over a network.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69370 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69370.json"
}
],
"title": "CVE-2026-69370"
},
{
"cve": "CVE-2026-69651",
"notes": [
{
"category": "description",
"text": "A vulnerability in .NET involving inefficient algorithmic complexity can be exploited by unauthorized attackers to cause denial of service over a network.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69651 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69651.json"
}
],
"title": "CVE-2026-69651"
},
{
"cve": "CVE-2026-69905",
"notes": [
{
"category": "description",
"text": "A missing authorization vulnerability in the Windows AppX Deployment Service allows an authorized attacker to perform local tampering, potentially compromising system integrity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69905.json"
}
],
"title": "CVE-2026-69905"
},
{
"cve": "CVE-2026-69914",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability in the Windows AppX Deployment Service allows an authorized local attacker to disclose sensitive information by reading memory beyond intended boundaries.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69914 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69914.json"
}
],
"title": "CVE-2026-69914"
},
{
"cve": "CVE-2026-69945",
"notes": [
{
"category": "description",
"text": "A missing authorization vulnerability in Windows AppX Deployment Extensions allows a local attacker to elevate privileges on the affected system.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69945 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69945.json"
}
],
"title": "CVE-2026-69945"
},
{
"cve": "CVE-2026-69969",
"notes": [
{
"category": "description",
"text": "An authorized attacker can exploit improper link resolution in the Windows AppX Deployment Service to locally disclose sensitive information.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69969 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69969.json"
}
],
"title": "CVE-2026-69969"
},
{
"cve": "CVE-2026-69979",
"notes": [
{
"category": "description",
"text": "An authorized attacker can locally bypass a security feature in the Windows AppX Deployment Service due to improper protection of an alternate execution path.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69979 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69979.json"
}
],
"title": "CVE-2026-69979"
},
{
"cve": "CVE-2026-70007",
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability in Microsoft .NET Framework allows attackers to execute arbitrary code by exploiting improper input validation, which is addressed by a security update.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70007 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70007.json"
}
],
"title": "CVE-2026-70007"
},
{
"cve": "CVE-2026-70035",
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability in Microsoft .NET Framework allows attackers to execute arbitrary code by exploiting improper input validation, which is addressed by a security update.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70035 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70035.json"
}
],
"title": "CVE-2026-70035"
},
{
"cve": "CVE-2026-70098",
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability in Visual Studio Code allows attackers to execute arbitrary code by tricking users into opening malicious repositories, with mitigation involving changes to environment variable handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70098 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70098.json"
}
],
"title": "CVE-2026-70098"
},
{
"cve": "CVE-2026-70159",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70159 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70159.json"
}
],
"title": "CVE-2026-70159"
},
{
"cve": "CVE-2026-70161",
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability in .NET allows an authorized attacker to escalate local privileges by improperly restricting directory pathname access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70161 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70161.json"
}
],
"title": "CVE-2026-70161"
},
{
"cve": "CVE-2026-70165",
"notes": [
{
"category": "description",
"text": "An improper link resolution vulnerability in the .NET framework allows an authorized local attacker to elevate privileges by exploiting file access mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70165 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70165.json"
}
],
"title": "CVE-2026-70165"
},
{
"cve": "CVE-2026-70174",
"notes": [
{
"category": "description",
"text": "A security vulnerability in .NET\u0027s standard input validation allows unauthorized remote code execution, posing significant risks to affected systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70174 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70174.json"
}
],
"title": "CVE-2026-70174"
},
{
"cve": "CVE-2026-70175",
"notes": [
{
"category": "description",
"text": "An open redirect vulnerability in ASP.NET Core enables attackers to redirect authenticated users to malicious sites, potentially exposing session information, and is addressed by updating the handling of open redirect requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70175 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70175.json"
}
],
"title": "CVE-2026-70175"
},
{
"cve": "CVE-2026-70179",
"notes": [
{
"category": "description",
"text": "An open redirect vulnerability in ASP.NET Core enables attackers to redirect authenticated users to malicious sites, potentially exposing session information, and is addressed by updating the handling of open redirect requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70179 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70179.json"
}
],
"title": "CVE-2026-70179"
},
{
"cve": "CVE-2026-70181",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70181 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70181.json"
}
],
"title": "CVE-2026-70181"
},
{
"cve": "CVE-2026-70183",
"notes": [
{
"category": "description",
"text": "An open redirect vulnerability in ASP.NET Core enables attackers to redirect authenticated users to malicious sites, potentially exposing session information, and is addressed by updating the handling of open redirect requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70183 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70183.json"
}
],
"title": "CVE-2026-70183"
},
{
"cve": "CVE-2026-70186",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70186 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70186.json"
}
],
"title": "CVE-2026-70186"
},
{
"cve": "CVE-2026-70188",
"notes": [
{
"category": "description",
"text": "An inconsistent interpretation of HTTP requests in ASP.NET Core allows unauthorized attackers to bypass security controls over a network, potentially compromising application security.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70188 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70188.json"
}
],
"title": "CVE-2026-70188"
},
{
"cve": "CVE-2026-70190",
"notes": [
{
"category": "description",
"text": "An improper link resolution vulnerability in the .NET framework allows an authorized local attacker to elevate privileges by exploiting file access mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70190 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70190.json"
}
],
"title": "CVE-2026-70190"
},
{
"cve": "CVE-2026-70194",
"notes": [
{
"category": "description",
"text": "A vulnerability in Microsoft .NET Framework allows attackers to bypass security by using expired certificates, which is addressed by an update enforcing proper certificate validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70194 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70194.json"
}
],
"title": "CVE-2026-70194"
},
{
"cve": "CVE-2026-70196",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in ASP.NET Core allows remote unauthenticated attackers to disrupt service by sending specially crafted web requests, addressed by updating request handling mechanisms.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70196 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70196.json"
}
],
"title": "CVE-2026-70196"
},
{
"cve": "CVE-2026-70197",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in the .NET framework allows unauthorized remote attackers to execute arbitrary code over a network, posing a significant security risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70197 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70197.json"
}
],
"title": "CVE-2026-70197"
},
{
"cve": "CVE-2026-83520",
"notes": [
{
"category": "description",
"text": "Deserialization of untrusted data in .NET environments can allow unauthorized attackers to execute remote code, posing significant security risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83520 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83520.json"
}
],
"title": "CVE-2026-83520"
},
{
"cve": "CVE-2026-84008",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84008 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84008.json"
}
],
"title": "CVE-2026-84008"
},
{
"cve": "CVE-2026-85363",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-85363 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85363.json"
}
],
"title": "CVE-2026-85363"
},
{
"cve": "CVE-2026-85849",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-85849 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85849.json"
}
],
"title": "CVE-2026-85849"
},
{
"cve": "CVE-2026-85934",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-85934 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85934.json"
}
],
"title": "CVE-2026-85934"
},
{
"cve": "CVE-2026-87697",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87697 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87697.json"
}
],
"title": "CVE-2026-87697"
},
{
"cve": "CVE-2026-88092",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-88092 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-88092.json"
}
],
"title": "CVE-2026-88092"
},
{
"cve": "CVE-2026-96224",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96224 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96224.json"
}
],
"title": "CVE-2026-96224"
},
{
"cve": "CVE-2026-96225",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96225 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96225.json"
}
],
"title": "CVE-2026-96225"
},
{
"cve": "CVE-2026-96229",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96229 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96229.json"
}
],
"title": "CVE-2026-96229"
},
{
"cve": "CVE-2026-96230",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96230 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96230.json"
}
],
"title": "CVE-2026-96230"
},
{
"cve": "CVE-2026-96231",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96231 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96231.json"
}
],
"title": "CVE-2026-96231"
},
{
"cve": "CVE-2026-96232",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96232 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96232.json"
}
],
"title": "CVE-2026-96232"
},
{
"cve": "CVE-2026-96233",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96233 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96233.json"
}
],
"title": "CVE-2026-96233"
},
{
"cve": "CVE-2026-96234",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96234 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96234.json"
}
],
"title": "CVE-2026-96234"
},
{
"cve": "CVE-2026-96235",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96235 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96235.json"
}
],
"title": "CVE-2026-96235"
},
{
"cve": "CVE-2026-96236",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96236 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96236.json"
}
],
"title": "CVE-2026-96236"
},
{
"cve": "CVE-2026-96237",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96237 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96237.json"
}
],
"title": "CVE-2026-96237"
},
{
"cve": "CVE-2026-96238",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96238 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96238.json"
}
],
"title": "CVE-2026-96238"
},
{
"cve": "CVE-2026-96957",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96957 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96957.json"
}
],
"title": "CVE-2026-96957"
},
{
"cve": "CVE-2026-96958",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96958 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96958.json"
}
],
"title": "CVE-2026-96958"
},
{
"cve": "CVE-2026-96959",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96959 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96959.json"
}
],
"title": "CVE-2026-96959"
},
{
"cve": "CVE-2026-96960",
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-96960 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-96960.json"
}
],
"title": "CVE-2026-96960"
},
{
"cve": "CVE-2026-102229",
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability in Visual Studio Code allows an authorized attacker to disclose sensitive information over a network by improperly limiting pathname access to a restricted directory.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102229 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102229.json"
}
],
"title": "CVE-2026-102229"
},
{
"cve": "CVE-2026-102230",
"notes": [
{
"category": "description",
"text": "A missing authorization vulnerability in Visual Studio Code allows unauthorized attackers to disclose sensitive information over a network, posing a significant security risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102230 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102230.json"
}
],
"title": "CVE-2026-102230"
},
{
"cve": "CVE-2026-102231",
"notes": [
{
"category": "description",
"text": "An improper resolution of path equivalence vulnerability in Visual Studio Code allows a local attacker to bypass security features, potentially compromising the integrity of the development environment.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102231 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102231.json"
}
],
"title": "CVE-2026-102231"
},
{
"cve": "CVE-2026-102232",
"notes": [
{
"category": "description",
"text": "An incorrect authorization vulnerability in Visual Studio Code allows a local attacker to bypass security controls, potentially compromising the integrity of the development environment.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102232 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102232.json"
}
],
"title": "CVE-2026-102232"
},
{
"cve": "CVE-2026-102233",
"notes": [
{
"category": "description",
"text": "A missing authorization vulnerability in Visual Studio Code allows a local attacker to bypass security controls, potentially leading to unauthorized actions within the application.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102233 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102233.json"
}
],
"title": "CVE-2026-102233"
},
{
"cve": "CVE-2026-102234",
"notes": [
{
"category": "description",
"text": "A vulnerability in Visual Studio Code enables unauthorized attackers to bypass security features by exploiting the application\u0027s reliance on untrusted network inputs.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102234 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102234.json"
}
],
"title": "CVE-2026-102234"
},
{
"cve": "CVE-2026-102235",
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability in Visual Studio Code allows attackers to execute arbitrary code by tricking users into opening malicious repositories, with mitigation involving changes to environment variable handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102235 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102235.json"
}
],
"title": "CVE-2026-102235"
},
{
"cve": "CVE-2026-102238",
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability in Visual Studio Code allows attackers to execute arbitrary code by tricking users into opening malicious repositories, with mitigation involving changes to environment variable handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102238 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102238.json"
}
],
"title": "CVE-2026-102238"
},
{
"cve": "CVE-2026-102851",
"notes": [
{
"category": "description",
"text": "An incorrect privilege assignment vulnerability in Visual Studio Code allows an authorized local attacker to bypass a security feature, potentially compromising the integrity of the development environment.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102851 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102851.json"
}
],
"title": "CVE-2026-102851"
},
{
"cve": "CVE-2026-102870",
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability in ASP.NET Core arises from improper source markup validation, enabling attackers to execute arbitrary code and potentially gain full system control with administrative privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102870 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102870.json"
}
],
"title": "CVE-2026-102870"
},
{
"cve": "CVE-2026-103572",
"notes": [
{
"category": "description",
"text": "Improper control of code generation in Visual Studio Tools for Applications and SQL Server Management Studio allows unauthorized remote code execution by attackers.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-103572 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103572.json"
}
],
"title": "CVE-2026-103572"
},
{
"cve": "CVE-2026-108398",
"notes": [
{
"category": "description",
"text": "An untrusted search path vulnerability in the .NET Framework allows an authorized local attacker to bypass a security feature, potentially compromising system integrity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-108398 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-108398.json"
}
],
"title": "CVE-2026-108398"
},
{
"cve": "CVE-2026-102869",
"notes": [
{
"category": "description",
"text": "A type confusion vulnerability in Microsoft .NET and Visual Studio enables unauthorized attackers to elevate privileges remotely over a network.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19",
"CSAFPID-20",
"CSAFPID-21",
"CSAFPID-22",
"CSAFPID-23",
"CSAFPID-24",
"CSAFPID-25",
"CSAFPID-26",
"CSAFPID-27",
"CSAFPID-28",
"CSAFPID-29",
"CSAFPID-30",
"CSAFPID-31",
"CSAFPID-32",
"CSAFPID-33",
"CSAFPID-34",
"CSAFPID-35",
"CSAFPID-36"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-102869 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102869.json"
}
],
"title": "CVE-2026-102869"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.