# Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) vulnerabilities Source: https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-x64 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 01:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-x64.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 42 vulnerabilities in Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): 3 in the last 7 days and 11 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-120796, was published on 10 November 2026. 8 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 3 - Last 30 days: 4 - Last 90 days: 11 - All time: 42 (1 critical, 1 exploited in the wild) ## About Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) .NET Core runtime for macOS on 64-bit x86 architecture. ## Latest Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) vulnerabilities - [CVE-2026-120796: Microsoft .NET algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-120796-inefficient-algorithmic-complexity-in-net-allows-an-unauthorized) (medium, CVSS 5.3, published 10 Nov 2026) - [CVE-2026-118746: .NET framework insecure failure mode security bypass](https://junglewise.ai/threats/cve-2026-118746-not-failing-securely-failing-open-in-net-allows-an-unauthorized) (medium, CVSS 6.8, published 10 Nov 2026) - [CVE-2026-109475: .NET stack-based buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-109475-stack-based-buffer-overflow-in-net-allows-an-unauthorized) (high, CVSS 7.5, published 10 Nov 2026) - [Microsoft .NET Brotli decoder out-of-bounds write](https://junglewise.ai/threats/microsoft-security-advisory-net-brotli-decoder-out-of-bounds-write-b42e3b43) (high, CVSS 8.1, published 3 Nov 2026) - [CVE-2026-96233: Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96233-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-96231: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges…](https://junglewise.ai/threats/cve-2026-96231-microsoft-security-advisory-net-and-visual-studio-elevation-of) (high, CVSS 7.8, published 13 Oct 2026) - [CVE-2026-96225: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges…](https://junglewise.ai/threats/cve-2026-96225-microsoft-security-advisory-net-and-visual-studio-elevation-of) (high, CVSS 7.8, published 13 Oct 2026) - [CVE-2026-70194: Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a…](https://junglewise.ai/threats/cve-2026-70194-microsoft-security-advisory-net-and-visual-studio-security) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-69651: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-69651-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-66822: Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a…](https://junglewise.ai/threats/cve-2026-66822-microsoft-security-advisory-net-and-visual-studio-information) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-58280: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-58280-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-62909: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.](https://junglewise.ai/threats/cve-2026-62909-microsoft-net-privilege-escalation-in-diagnostics-ipc) (high, CVSS 7.8, published 11 Aug 2026) - [CVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-62901-microsoft-net-denial-of-service-in-system-net-websockets) (high, CVSS 7.5, published 11 Aug 2026) - [CVE-2026-62899: Microsoft .NET security feature bypass in System.Net.HttpListener](https://junglewise.ai/threats/cve-2026-62899-microsoft-net-security-feature-bypass-in-system-net-httplistener) (medium, CVSS 5.9, published 11 Aug 2026) - [CVE-2026-50659: Microsoft .NET and Visual Studio spoofing vulnerability](https://junglewise.ai/threats/cve-2026-50659-microsoft-net-and-visual-studio-spoofing-vulnerability) (medium, CVSS 6.5, published 14 Jul 2026) - [CVE-2026-50651: Microsoft .NET denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-50651-microsoft-net-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-50528: Microsoft .NET incorrect authorization security bypass](https://junglewise.ai/threats/cve-2026-50528-microsoft-net-incorrect-authorization-security-bypass) (high, CVSS 8.2, published 14 Jul 2026) - [CVE-2026-50524: Microsoft .NET Framework denial of service via improper input validation](https://junglewise.ai/threats/cve-2026-50524-microsoft-net-framework-denial-of-service-via-improper-input) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-47302: Microsoft .NET denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-47302-microsoft-net-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-57108: Microsoft .NET Core type confusion denial of service](https://junglewise.ai/threats/cve-2026-57108-microsoft-net-core-type-confusion-denial-of-service) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-32178: Microsoft .NET SMTP command injection in MailAddress parsing](https://junglewise.ai/threats/cve-2026-32178-microsoft-net-smtp-command-injection-in-mailaddress-parsing) (high, CVSS 7.5, published 14 Apr 2026) - [CVE-2026-26127: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2026-26127-net-denial-of-service-vulnerability) (low, CVSS 3.1, published 11 Mar 2026) - [CVE-2025-55248: Microsoft Security Advisory : .NET Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2025-55248-microsoft-security-advisory-net-information-disclosure) (low, CVSS 3.1, published 15 Oct 2025) - [CVE-2025-30399: Microsoft Security Advisory | .NET Remote Code Vulnerability](https://junglewise.ai/threats/cve-2025-30399-microsoft-security-advisory-net-remote-code-vulnerability) (low, CVSS 3.1, published 11 Jun 2025) - [CVE-2025-21176: Microsoft Security Advisory | .NET and Visual Studio Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2025-21176-microsoft-security-advisory-net-and-visual-studio-remote-code) (low, CVSS 3.1, published 14 Jan 2025) ## Most severe Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) vulnerabilities - [CVE-2020-1147: .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-1147-microsoft-net-framework-sharepoint-and-visual-studio-remote-code) (critical, exploited in the wild, CVSS 3.1, published 24 May 2022) - [CVE-2026-50528: Microsoft .NET incorrect authorization security bypass](https://junglewise.ai/threats/cve-2026-50528-microsoft-net-incorrect-authorization-security-bypass) (high, CVSS 8.2, published 14 Jul 2026) - [Microsoft .NET Brotli decoder out-of-bounds write](https://junglewise.ai/threats/microsoft-security-advisory-net-brotli-decoder-out-of-bounds-write-b42e3b43) (high, CVSS 8.1, published 3 Nov 2026) - [CVE-2026-96231: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges…](https://junglewise.ai/threats/cve-2026-96231-microsoft-security-advisory-net-and-visual-studio-elevation-of) (high, CVSS 7.8, published 13 Oct 2026) - [CVE-2026-96225: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges…](https://junglewise.ai/threats/cve-2026-96225-microsoft-security-advisory-net-and-visual-studio-elevation-of) (high, CVSS 7.8, published 13 Oct 2026) - [CVE-2026-62909: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.](https://junglewise.ai/threats/cve-2026-62909-microsoft-net-privilege-escalation-in-diagnostics-ipc) (high, CVSS 7.8, published 11 Aug 2026) - [CVE-2026-32178: Microsoft .NET SMTP command injection in MailAddress parsing](https://junglewise.ai/threats/cve-2026-32178-microsoft-net-smtp-command-injection-in-mailaddress-parsing) (high, CVSS 7.5, published 14 Apr 2026) - [CVE-2026-109475: .NET stack-based buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-109475-stack-based-buffer-overflow-in-net-allows-an-unauthorized) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-62901-microsoft-net-denial-of-service-in-system-net-websockets) (high, CVSS 7.5, published 11 Aug 2026) - [CVE-2026-50524: Microsoft .NET Framework denial of service via improper input validation](https://junglewise.ai/threats/cve-2026-50524-microsoft-net-framework-denial-of-service-via-improper-input) (high, CVSS 7.5, published 14 Jul 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 7 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 3 | 0 | 0 | ## Other NuGet technologies - [Microsoft.ChakraCore (NuGet)](https://junglewise.ai/threats/technologies/microsoft-chakracore): 247 vulnerabilities - [Magick.NET-Q16-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-anycpu): 167 vulnerabilities - [Magick.NET-Q16-HDRI-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-anycpu): 162 vulnerabilities - [Magick.NET-Q8-AnyCPU (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-anycpu): 162 vulnerabilities - [Magick.NET-Q16-HDRI-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x86): 160 vulnerabilities - [Magick.NET-Q8-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q8-x86): 160 vulnerabilities - [Magick.NET-Q16-x86 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-x86): 159 vulnerabilities - [Magick.NET-Q16-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-HDRI-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-hdri-x64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-arm64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-arm64): 157 vulnerabilities - [Magick.NET-Q16-OpenMP-x64 (NuGet)](https://junglewise.ai/threats/technologies/magick-net-q16-openmp-x64): 157 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft.NetCore.App.Runtime.osx-x64 (NuGet) vulnerabilities", https://junglewise.ai/threats/technologies/microsoft-netcore-app-runtime-osx-x64, 13 November 2026.