# Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) vulnerabilities Source: https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-x86 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 01:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-x86.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 47 vulnerabilities in Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet): 12 in the last 7 days and 20 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-118749, was published on 10 November 2026. 8 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. ## Counts - Last 7 days: 12 - Last 30 days: 12 - Last 90 days: 20 - All time: 47 (4 critical, 1 exploited in the wild) ## About Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) The Windows x86 runtime for hosting ASP.NET Core applications. ## Latest Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) vulnerabilities - [CVE-2026-118749: ASP.NET Core inefficient algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-118749-inefficient-algorithmic-complexity-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-118748: Microsoft ASP.NET Core denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-118748-allocation-of-resources-without-limits-or-throttling-in-asp-net) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114157: Microsoft ASP.NET Core race condition privilege escalation](https://junglewise.ai/threats/cve-2026-114157-concurrent-execution-using-shared-resource-with-improper) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114156: ASP.NET Core input validation bypass allows security feature circumvention](https://junglewise.ai/threats/cve-2026-114156-improper-input-validation-in-asp-net-core-allows-an-unauthorized) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-114154: Microsoft ASP.NET Core denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-114154-uncontrolled-resource-consumption-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114150: ASP.NET Core information disclosure via uninitialized resource](https://junglewise.ai/threats/cve-2026-114150-use-of-uninitialized-resource-in-asp-net-core-allows-an) (medium, CVSS 5.9, published 10 Nov 2026) - [CVE-2026-114149: Microsoft ASP.NET Core denial of service via resource consumption](https://junglewise.ai/threats/cve-2026-114149-uncontrolled-resource-consumption-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114147: Microsoft ASP.NET Core memory leak denial of service](https://junglewise.ai/threats/cve-2026-114147-missing-release-of-memory-after-effective-lifetime-in-asp-net) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-114146: Microsoft ASP.NET Core incorrect authorization privilege escalation](https://junglewise.ai/threats/cve-2026-114146-incorrect-authorization-in-asp-net-core-allows-an-authorized) (critical, CVSS 9, published 10 Nov 2026) - [CVE-2026-109481: Microsoft ASP.NET Core cross-site request forgery privilege escalation](https://junglewise.ai/threats/cve-2026-109481-cross-site-request-forgery-csrf-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-109478: ASP.NET Core algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-109478-inefficient-algorithmic-complexity-in-asp-net-core-allows-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-109476: Microsoft ASP.NET Core improper output encoding information disclosure](https://junglewise.ai/threats/cve-2026-109476-improper-encoding-or-escaping-of-output-in-asp-net-core-allows) (medium, CVSS 6.1, published 10 Nov 2026) - [CVE-2026-70186: ASP.NET Core Kestrel denial of service in HTTP/3 handling](https://junglewise.ai/threats/cve-2026-70186-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70188: Microsoft ASP.NET Core Kestrel HTTP request smuggling in HTTP/2](https://junglewise.ai/threats/cve-2026-70188-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-96236: Microsoft ASP.NET Core Localization denial of service](https://junglewise.ai/threats/cve-2026-96236-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70183: Microsoft ASP.NET Core authorization bypass in Blazor AuthorizeRouteView](https://junglewise.ai/threats/cve-2026-70183-microsoft-security-advisory-asp-net-core-security-feature-bypass) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70196: ASP.NET Core denial of service in FormPipeReader](https://junglewise.ai/threats/cve-2026-70196-microsoft-security-advisory-asp-net-core-denial-of-service) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-70181: Microsoft ASP.NET Core denial of service in multipart processing](https://junglewise.ai/threats/cve-2026-70181-microsoft-security-advisory-asp-net-core-denial-of-service) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.4, published 13 Oct 2026) - [CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-70175-microsoft-security-advisory-asp-net-core-elevation-of-privilege) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-56170: Microsoft ASP.NET Core denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-56170-microsoft-asp-net-core-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service](https://junglewise.ai/threats/cve-2026-42899-microsoft-asp-net-core-infinite-loop-denial-of-service) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-26130-microsoft-asp-net-core-denial-of-service-via-uncontrolled) (high, CVSS 7.5, published 10 Mar 2026) - [CVE-2025-55315: Microsoft Security Advisory : .NET Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2025-55315-microsoft-security-advisory-net-security-feature-bypass) (low, CVSS 3.1, published 14 Oct 2025) - [CVE-2025-24070: Microsoft Security Advisory : .NET Elevation of Privilege Vulnerability](https://junglewise.ai/threats/cve-2025-24070-microsoft-security-advisory-net-elevation-of-privilege) (low, CVSS 3.1, published 11 Mar 2025) ## Most severe Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) vulnerabilities - [CVE-2023-38180: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2023-38180-microsoft-net-core-and-visual-studio-denial-of-service) (critical, exploited in the wild, CVSS 3.1, published 9 Aug 2023) - [CVE-2026-88092: Microsoft ASP.NET Core Kestrel HTTP request smuggling](https://junglewise.ai/threats/cve-2026-88092-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.4, published 13 Oct 2026) - [CVE-2026-70188: Microsoft ASP.NET Core Kestrel HTTP request smuggling in HTTP/2](https://junglewise.ai/threats/cve-2026-70188-microsoft-security-advisory-asp-net-core-security-feature-bypass) (critical, CVSS 9.1, published 13 Oct 2026) - [CVE-2026-114146: Microsoft ASP.NET Core incorrect authorization privilege escalation](https://junglewise.ai/threats/cve-2026-114146-incorrect-authorization-in-asp-net-core-allows-an-authorized) (critical, CVSS 9, published 10 Nov 2026) - [CVE-2026-70175: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.](https://junglewise.ai/threats/cve-2026-70175-microsoft-security-advisory-asp-net-core-elevation-of-privilege) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2022-29145: Microsoft .NET denial of service in HTML form parsing](https://junglewise.ai/threats/cve-2022-29145-microsoft-net-denial-of-service-in-html-form-parsing) (high, CVSS 7.5, published 30 Aug 2022) - [CVE-2022-38013: Microsoft .NET stack overflow in ASP.NET Core model binding](https://junglewise.ai/threats/cve-2022-38013-microsoft-net-stack-overflow-in-asp-net-core-model-binding) (high, CVSS 7.5, published 15 Sep 2022) - [CVE-2022-24464: Microsoft .NET denial of service in HTTP form parsing](https://junglewise.ai/threats/cve-2022-24464-microsoft-net-denial-of-service-in-http-form-parsing) (high, CVSS 7.5, published 21 Oct 2022) - [CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service](https://junglewise.ai/threats/cve-2026-42899-microsoft-asp-net-core-infinite-loop-denial-of-service) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-26130: Microsoft ASP.NET Core denial of service via uncontrolled resource allocation](https://junglewise.ai/threats/cve-2026-26130-microsoft-asp-net-core-denial-of-service-via-uncontrolled) (high, CVSS 7.5, published 10 Mar 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 8 | 2 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 12 | 1 | 0 | ## Other NuGet technologies - [Microsoft.ChakraCore (NuGet)](https://junglewise.ai/threats/technologies/microsoft-chakracore): 247 vulnerabilities - [Magick.NET-Q16-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-anycpu): 167 vulnerabilities - [Magick.NET-Q16-HDRI-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu): 162 vulnerabilities - [Magick.NET-Q8-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-anycpu): 162 vulnerabilities - [Magick.NET-Q16-HDRI-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86): 160 vulnerabilities - [Magick.NET-Q8-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x86): 160 vulnerabilities - [Magick.NET-Q16-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x86): 159 vulnerabilities - [Magick.NET-Q16-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64): 157 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet) vulnerabilities", https://junglewise.ai/threats/technologies/microsoft-aspnetcore-app-runtime-win-x86, 13 November 2026.