Critical NuGet package vulnerabilities
The Beam CVE database tracks 31 critical package advisories for NuGet: 31 critical severity. The newest is CVE-2026-105016, published Oct 13, 2026 and fixed in 2.5.11-ci.159417053.
Critical-severity advisories for NuGet packages from the GitHub Advisory Database, published since 2024. AI coding agents install packages on their own, so a vulnerable or malicious dependency can reach a project without a human picking it. Advisories for AI tools themselves are listed under each tool.
- Vulnerabilities tracked
- 31
- Critical
- 31
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 4
All entries, newest first
CVE-2026-105016 · NuGet
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability
critical9.8Oct 13, 2026CVE-2026-70188 · NuGet
Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability
critical9.1Oct 13, 2026CVE-2026-88092 · NuGet
Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability
critical9.4Oct 13, 2026CVE-2026-105794 · NuGet
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
critical9.1Oct 6, 2026CVE-2026-75513 · NuGet
Marten's LINQ provider has SQL injection via unescaped string literals
critical9.1Sep 17, 2026CVE-2026-62815 · NuGet
Microsoft QUIC: Remote Code Execution Vulnerability
critical9.8Sep 8, 2026CVE-2026-59864 · NuGet
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
critical9.3Jul 24, 2026CVE-2026-59865 · NuGet
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
critical9.3Jul 24, 2026CVE-2026-54782 · NuGet
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
critical10.0Jun 19, 2026GHSA-c8qj-jx8j-fg2w · NuGet
DotVVM: Missing authorization in AuthorizeActionFilter
critical9.2Jun 19, 2026CVE-2026-45288 · NuGet
Marten has an injection vulnerability in its full-text search regConfig parameter
critical9.8May 14, 2026CVE-2026-40372 · NuGet
Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege
critical9.1Apr 23, 2026CVE-2026-32179 · NuGet
MsQuic has a Remote Elevation of Privilege Vulnerability
critical9.8Apr 16, 2026CVE-2026-40324 · NuGet
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
critical9.1Apr 16, 2026GHSA-5wr9-m6jw-xx44 · NuGet
Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse
critical9.1Mar 24, 2026CVE-2026-24838 · NuGet
DotNetNuke.Core Vulnerable to Stored XSS via Module Title
critical9.1Jan 28, 2026CVE-2025-68924 · NuGet
UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation
critical9.9No fixJan 13, 2026CVE-2025-64095 · NuGet
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
critical10.0Oct 29, 2025CVE-2025-54539 · NuGet
Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability
critical9.8Oct 16, 2025CVE-2025-55315 · NuGet
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
critical9.9Oct 14, 2025CVE-2025-61778 · NuGet
Akka.Remote TLS did not properly implement certificate-based authentication
critical9.3Oct 7, 2025CVE-2025-59545 · NuGet
DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module
critical9.0Sep 23, 2025CVE-2025-43858 · NuGet
YoutubeDLSharp allows command injection on windows system due to non sanitized arguments
critical9.2Apr 23, 2025CVE-2025-29953 · NuGet
Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability
critical9.8Apr 18, 2025CVE-2025-24894 · NuGet
The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass
critical9.1Feb 18, 2025CVE-2025-24895 · NuGet
AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass
critical9.1Feb 18, 2025CVE-2024-43498 · NuGet
.NET Remote Code Execution Vulnerability
critical9.8Nov 12, 2024CVE-2024-51501 · NuGet
CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
critical9.8Nov 4, 2024CVE-2024-28698 · NuGet
CLSA Directory Traversal vulnerability
critical9.8Jul 22, 2024CVE-2024-35264 · NuGet
Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability
critical8.1Jul 9, 2024CVE-2024-0057 · NuGet
NuGet Client Security Feature Bypass Vulnerability
critical9.1Feb 13, 2024
Withdrawn advisories (4)
GHSA-2q33-cf8w-7q23
Duplicate Advisory: Microsoft QUIC Remote Code Execution Vulnerability
critical9.8WithdrawnAug 11, 2026CVE-2025-64113
Withdrawn Advisory: Emby Server API Vulnerability allowing to gain administrative access without precondition
critical9.3WithdrawnDec 8, 2025GHSA-8rxm-6783-qh55
Duplicate Advisory: .NET and Visual Studio Remote Code Execution Vulnerability
critical9.8WithdrawnNov 12, 2024GHSA-jw42-5m4v-9c8g
Duplicate Advisory: NuGet Client Security Feature Bypass Vulnerability
critical9.1WithdrawnJan 9, 2024