# Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) vulnerabilities Source: https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-arm Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-arm.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 30 vulnerabilities in Microsoft.AspNetCore.App.Runtime.win-arm (NuGet): 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-70183, was published on 13 October 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 30 (0 critical, 0 exploited in the wild) ## About Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) The Windows ARM64 runtime package for the ASP.NET Core shared framework. ## Latest Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) vulnerabilities - [CVE-2026-70183: Microsoft ASP.NET Core authorization bypass in Blazor AuthorizeRouteView](https://junglewise.ai/threats/cve-2026-70183-microsoft-security-advisory-asp-net-core-security-feature-bypass) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70196: ASP.NET Core denial of service in FormPipeReader](https://junglewise.ai/threats/cve-2026-70196-microsoft-security-advisory-asp-net-core-denial-of-service) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-70181: Microsoft ASP.NET Core denial of service in multipart processing](https://junglewise.ai/threats/cve-2026-70181-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-70175-microsoft-security-advisory-asp-net-core-elevation-of-privilege) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-56170: Microsoft ASP.NET Core denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-56170-microsoft-asp-net-core-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service](https://junglewise.ai/threats/cve-2026-42899-microsoft-asp-net-core-infinite-loop-denial-of-service) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-26130-microsoft-asp-net-core-denial-of-service-via-uncontrolled) (high, CVSS 7.5, published 10 Mar 2026) - [CVE-2025-55315: Microsoft Security Advisory : .NET Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-55315-microsoft-security-advisory-net-security-feature-bypass) (low, CVSS 3.1, published 14 Oct 2025) - [CVE-2025-24070: Microsoft Security Advisory : .NET Elevation of Privilege Vulnerability](https://junglewise.ai/threats/cve-2025-24070-microsoft-security-advisory-net-elevation-of-privilege) (low, CVSS 3.1, published 11 Mar 2025) - [CVE-2024-38229: Microsoft Security Advisory | .NET Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2024-38229-microsoft-security-advisory-net-remote-code-execution) (low, CVSS 3.1, published 8 Oct 2024) - [CVE-2024-38168: Microsoft Security Advisory | .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2024-38168-microsoft-security-advisory-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 13 Aug 2024) - [CVE-2024-35264: Microsoft Security Advisory | .NET Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2024-35264-microsoft-security-advisory-net-remote-code-execution) (low, CVSS 3.1, published 9 Jul 2024) - [CVE-2024-30046: Microsoft Security Advisory | .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2024-30046-microsoft-security-advisory-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 14 May 2024) - [CVE-2024-21386: Microsoft Security Advisory : .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2024-21386-microsoft-security-advisory-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 13 Feb 2024) - [CVE-2022-34716: .NET Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2022-34716-net-information-disclosure-vulnerability) (low, CVSS 3.1, published 3 Feb 2024) - [CVE-2023-38178: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2023-38178-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 9 Aug 2023) - [CVE-2023-33170: Microsoft Security Advisory : .NET Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2023-33170-microsoft-security-advisory-net-security-feature-bypass) (low, CVSS 3.1, published 11 Jul 2023) - [CVE-2022-23267: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2022-23267-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 21 Oct 2022) - [CVE-2022-24464: Microsoft .NET denial of service in HTTP form parsing](https://junglewise.ai/threats/cve-2022-24464-microsoft-net-denial-of-service-in-http-form-parsing) (high, CVSS 7.5, published 21 Oct 2022) - [CVE-2022-21986: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2022-21986-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 21 Oct 2022) - [CVE-2022-38013: Microsoft .NET stack overflow in ASP.NET Core model binding](https://junglewise.ai/threats/cve-2022-38013-microsoft-net-stack-overflow-in-asp-net-core-model-binding) (high, CVSS 7.5, published 15 Sep 2022) - [CVE-2022-29145: Microsoft .NET denial of service in HTML form parsing](https://junglewise.ai/threats/cve-2022-29145-microsoft-net-denial-of-service-in-html-form-parsing) (high, CVSS 7.5, published 30 Aug 2022) - [CVE-2022-29117: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2022-29117-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 30 Aug 2022) - [Duplicate Advisory: .NET Information Disclosure Vulnerability](https://junglewise.ai/threats/duplicate-advisory-net-information-disclosure-vulnerability-73e25e1b) (low, CVSS 3.1, published 10 Aug 2022) - [CVE-2021-1723: ASP.NET Core and Visual Studio Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2021-1723-asp-net-core-and-visual-studio-denial-of-service-vulnerability) (low, CVSS 3.1, published 24 May 2022) ## Most severe Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) vulnerabilities - [CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-70175-microsoft-security-advisory-asp-net-core-elevation-of-privilege) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2022-29145: Microsoft .NET denial of service in HTML form parsing](https://junglewise.ai/threats/cve-2022-29145-microsoft-net-denial-of-service-in-html-form-parsing) (high, CVSS 7.5, published 30 Aug 2022) - [CVE-2022-38013: Microsoft .NET stack overflow in ASP.NET Core model binding](https://junglewise.ai/threats/cve-2022-38013-microsoft-net-stack-overflow-in-asp-net-core-model-binding) (high, CVSS 7.5, published 15 Sep 2022) - [CVE-2022-24464: Microsoft .NET denial of service in HTTP form parsing](https://junglewise.ai/threats/cve-2022-24464-microsoft-net-denial-of-service-in-http-form-parsing) (high, CVSS 7.5, published 21 Oct 2022) - [CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service](https://junglewise.ai/threats/cve-2026-42899-microsoft-asp-net-core-infinite-loop-denial-of-service) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-26130-microsoft-asp-net-core-denial-of-service-via-uncontrolled) (high, CVSS 7.5, published 10 Mar 2026) - [CVE-2026-56170: Microsoft ASP.NET Core denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-56170-microsoft-asp-net-core-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-70181: Microsoft ASP.NET Core denial of service in multipart processing](https://junglewise.ai/threats/cve-2026-70181-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70183: Microsoft ASP.NET Core authorization bypass in Blazor AuthorizeRouteView](https://junglewise.ai/threats/cve-2026-70183-microsoft-security-advisory-asp-net-core-security-feature-bypass) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70196: ASP.NET Core denial of service in FormPipeReader](https://junglewise.ai/threats/cve-2026-70196-microsoft-security-advisory-asp-net-core-denial-of-service) (medium, CVSS 5.9, published 13 Oct 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other NuGet technologies - [Microsoft.ChakraCore (NuGet)](https://junglewise.ai/threats/technologies/microsoft-chakracore): 247 vulnerabilities - [Magick.NET-Q16-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-anycpu): 167 vulnerabilities - [Magick.NET-Q16-HDRI-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu): 162 vulnerabilities - [Magick.NET-Q8-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-anycpu): 162 vulnerabilities - [Magick.NET-Q16-HDRI-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86): 160 vulnerabilities - [Magick.NET-Q8-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x86): 160 vulnerabilities - [Magick.NET-Q16-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x86): 159 vulnerabilities - [Magick.NET-Q16-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64): 157 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft.AspNetCore.App.Runtime.win-arm (NuGet) vulnerabilities", https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-arm, 13 November 2026.