Package ecosystem
NuGet package vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 1,194 vulnerabilities in NuGet packages: 42 in the last 7 days and 135 in the last 90 days, 40 of them critical and 15 exploited in the wild. The most recent, Microsoft TestPlatform CLI privilege escalation in artifact postprocessor, was published on 11 November 2026. 46 vulnerabilities in the last four weeks, up 92% on the four before (24). 3 critical against 2. 172 packages have a page of their own.
- Last 7 days
- 42
- Last 90 days
- 135
- Critical, all time
- 40
- Exploited in the wild
- 15
About NuGet
The package manager for the .NET ecosystem.
NuGet packages
- Microsoft.ChakraCore (NuGet)247
- Magick.NET-Q16-AnyCPU (NuGet)167
- Magick.NET-Q16-HDRI-AnyCPU (NuGet)162
- Magick.NET-Q8-AnyCPU (NuGet)162
- Magick.NET-Q16-HDRI-x86 (NuGet)160
- Magick.NET-Q8-x86 (NuGet)160
- Magick.NET-Q16-x86 (NuGet)159
- Magick.NET-Q16-arm64 (NuGet)157
- Magick.NET-Q16-HDRI-OpenMP-arm64 (NuGet)157
- Magick.NET-Q16-HDRI-x64 (NuGet)157
- Magick.NET-Q16-OpenMP-arm64 (NuGet)157
- Magick.NET-Q16-OpenMP-x64 (NuGet)157
- Magick.NET-Q8-arm64 (NuGet)157
- Magick.NET-Q16-HDRI-arm64 (NuGet)156
- Magick.NET-Q8-OpenMP-arm64 (NuGet)156
- Magick.NET-Q8-OpenMP-x64 (NuGet)156
- Magick.NET-Q16-x64 (NuGet)153
- Magick.NET-Q8-x64 (NuGet)151
- Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet)96
- Magick.NET-Q16-OpenMP-x86 (NuGet)67
- Microsoft.NetCore.App.Runtime.win-x86 (NuGet)56
- Microsoft.NetCore.App.Runtime.win-x64 (NuGet)52
- Microsoft.NetCore.App.Runtime.win-arm64 (NuGet)51
- Microsoft.AspNetCore.App.Runtime.win-x64 (NuGet)48
- Microsoft.AspNetCore.App.Runtime.win-x86 (NuGet)47
- Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet)46
- Microsoft.NetCore.App.Runtime.linux-arm (NuGet)46
- Microsoft.NetCore.App.Runtime.linux-x64 (NuGet)46
- Microsoft.AspNetCore.App.Runtime.win-arm64 (NuGet)45
- Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet)45
- Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet)45
- Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet)45
- Microsoft.AspNetCore.App.Runtime.linux-x64 (NuGet)43
- Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet)43
- Microsoft.AspNetCore.App.Runtime.linux-arm64 (NuGet)42
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64 (NuGet)42
- Microsoft.AspNetCore.App.Runtime.osx-x64 (NuGet)42
- Microsoft.NetCore.App.Runtime.osx-x64 (NuGet)42
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 (NuGet)41
- Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet)38
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm (NuGet)37
- DotNetNuke.Core (NuGet)36
- Microsoft.AspNetCore.App.Runtime.osx-arm64 (NuGet)35
- Microsoft.NetCore.App.Runtime.win-arm (NuGet)35
- Microsoft.AspNetCore.App.Runtime.win-arm (NuGet)30
- Umbraco.Cms (NuGet)29
- Microsoft.WindowsDesktop.App.Runtime.win-x64 (NuGet)25
- Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet)24
- Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet)23
- System.Security.Cryptography.Xml (NuGet)16
- MessagePack (NuGet)15
- scriban (NuGet)15
- Scriban.Signed (NuGet)14
- SixLabors.ImageSharp (NuGet)14
- Microsoft.OpenApi.Kiota (NuGet)13
- Microsoft.OpenApi.Kiota.Builder (NuGet)12
- OPCFoundation.NetStandard.Opc.Ua.Core (NuGet)11
- Microsoft.AspNetCore.All (NuGet)10
- Microsoft.NETCore.App (NuGet)10
- TinyMCE (NuGet)10
- CefSharp.Common (NuGet)8
- CoreWCF.Primitives (NuGet)8
- jQuery.UI.Combined (NuGet)8
- Microsoft.AspNetCore.App (NuGet)8
- OPCFoundation.NetStandard.Opc.Ua (NuGet)8
- Piranha (NuGet)8
- DotVVM (NuGet)7
- Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet)7
- Microsoft.Native.Quic.MsQuic.Schannel (NuGet)7
- UmbracoCms (NuGet)7
- CefSharp.WinForms (NuGet)6
- CefSharp.Wpf (NuGet)6
- CefSharp.Wpf.HwndHost (NuGet)6
- Dnn.Platform (NuGet)6
- Microsoft.AspNetCore.Mvc.Core (NuGet)6
- Microsoft.AspNetCore.Server.Kestrel.Core (NuGet)6
- Microsoft.DiaSymReader.Native (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.linux-arm (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.linux-arm64 (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.linux-musl-x64 (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.linux-x64 (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-arm64 (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.LLVM.linux-x64 (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.LLVM.osx-x64 (NuGet)6
- Microsoft.NETCore.App.Runtime.Mono.osx-x64 (NuGet)6
- Microsoft.AspNetCore.Mvc.Cors (NuGet)5
- Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-arm64 (NuGet)5
- Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.linux-x64 (NuGet)5
- Microsoft.NETCore.App.Runtime.Mono.LLVM.AOT.osx-x64 (NuGet)5
- Microsoft.NETCore.App.Runtime.rhel.6-x64 (NuGet)5
- NuGet.CommandLine (NuGet)5
- SSCMS (NuGet)5
- System.Net.Http (NuGet)5
- System.Text.Encodings.Web (NuGet)5
- Umbraco.Forms (NuGet)5
- UmbracoCms.Core (NuGet)5
- AjaxNetProfessional (NuGet)4
- Aspire.Cli (NuGet)4
- BouncyCastle (NuGet)4
- Microsoft.AspNetCore.Mvc (NuGet)4
- Microsoft.AspNetCore.Mvc.Abstractions (NuGet)4
- Microsoft.AspNetCore.Mvc.ApiExplorer (NuGet)4
- Microsoft.AspNetCore.Mvc.DataAnnotations (NuGet)4
- Microsoft.AspNetCore.Mvc.Formatters.Json (NuGet)4
- Microsoft.AspNetCore.Mvc.Formatters.Xml (NuGet)4
- Microsoft.AspNetCore.Mvc.Localization (NuGet)4
- Microsoft.AspNetCore.Mvc.Razor (NuGet)4
- Microsoft.AspNetCore.Mvc.Razor.Host (NuGet)4
- Microsoft.AspNetCore.Mvc.TagHelpers (NuGet)4
- Microsoft.AspNetCore.Mvc.ViewFeatures (NuGet)4
- Microsoft.AspNetCore.Mvc.WebApiCompatShim (NuGet)4
- Microsoft.AspNetCore.Server.HttpSys (NuGet)4
- net.sf.mpxj (NuGet)4
- net.sf.mpxj-for-csharp (NuGet)4
- net.sf.mpxj-for-vb (NuGet)4
- NuGet.Commands (NuGet)4
- Steeltoe.Management.Endpoint (NuGet)4
- Serenity.Net.Core (NuGet)4
- SharpZipLib (NuGet)4
- Snowflake.Data (NuGet)4
- System.Formats.Nrbf (NuGet)4
- System.Net.Http.WinHttpHandler (NuGet)4
- System.Net.Security (NuGet)4
- System.Net.WebSockets.Client (NuGet)4
- Umbraco.Cms.Core (NuGet)4
- Umbraco.Cms.Web.BackOffice (NuGet)4
- UmbracoForms (NuGet)4
- BouncyCastle.Cryptography (NuGet)3
- CefSharp.Common.NETCore (NuGet)3
- Microsoft.AspNetCore.Authentication.Negotiate (NuGet)3
- Microsoft.AspNetCore.Http.Connections (NuGet)3
- Microsoft.AspNetCore.Identity (NuGet)3
- Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet)3
- Microsoft.AspNetCore.SignalR.StackExchangeRedis (NuGet)3
- Microsoft.Build.Tasks.Core (NuGet)3
- Microsoft.NETCore.App.Runtime.browser-wasm (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.android-arm (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.android-arm64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.android-x64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.android-x86 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.browser-wasm (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.ios-arm64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.iossimulator-arm64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.iossimulator-x64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.maccatalyst-arm64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.maccatalyst-x64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.osx-arm64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.tvos-arm64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.tvossimulator-arm64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.tvossimulator-x64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.win-x64 (NuGet)3
- Microsoft.NETCore.App.Runtime.Mono.win-x86 (NuGet)3
- MPXJ.Net (NuGet)3
- bootstrap (NuGet)3
- bootstrap.sass (NuGet)3
- HtmlSanitizer (NuGet)3
- log4net (NuGet)3
- SharpCompress (NuGet)3
- Steeltoe.Discovery.Eureka (NuGet)3
- OPCFoundation.NetStandard.Opc.Ua.Server (NuGet)3
- OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet)3
- Oqtane.Framework (NuGet)3
- Oqtane.Server (NuGet)3
- PeterO.Cbor (NuGet)3
- SIPSorcery (NuGet)3
- SSH.NET (NuGet)3
- Sustainsys.Saml2 (NuGet)3
- System.Private.Uri (NuGet)3
- System.Security.Cryptography.Pkcs (NuGet)3
- System.Text.Json (NuGet)3
- wix (NuGet)3
- YAFNET.Core (NuGet)3
Latest NuGet package vulnerabilities
- Microsoft TestPlatform CLI privilege escalation in artifact postprocessormediumCVSS 6.5
- .NET Aspire information disclosure in log fileshighCVSS 7.3
- .NET Aspire privilege escalation in temporary file handlinghighCVSS 7.3
- Microsoft Visual Studio heap buffer overflow RCEhighCVSS 8.8
- Microsoft Aspire Dashboard SDK missing authorization security feature bypasscriticalCVSS 9.1
- Microsoft Visual Studio heap-based buffer overflowhighCVSS 8.8
- Microsoft ASP.NET Core race condition privilege escalationhighCVSS 7.5
- Microsoft Visual Studio stack-based buffer overflowhighCVSS 8.8
- ASP.NET Core security feature bypass via input validationmediumCVSS 6.5
- Microsoft Visual Studio deserialization remote code executionhighCVSS 8.8
- Microsoft ASP.NET Core denial of service via resource consumptionhighCVSS 7.5
- Microsoft Visual Studio heap-based buffer overflowhighCVSS 8.8
- Microsoft ASP.NET Core SignalR memory leak denial of servicehighCVSS 7.5
- ASP.NET Core inefficient algorithmic complexity denial of servicehighCVSS 7.5
- Microsoft .NET elevation of privilege in access controlhighCVSS 7.5
- CVE-2026-120796: Microsoft .NET algorithmic complexity denial of servicemediumCVSS 5.3EPSS 1.2%
- CVE-2026-120792: .NET Aspire sensitive information insertion in log filehighCVSS 7.3
- CVE-2026-120778: .NET Aspire insecure temporary file creation local privilege escalationhighCVSS 7.3
- CVE-2026-120006: .NET Aspire insertion of sensitive information into sent datahighCVSS 7.5EPSS 0.4%
- CVE-2026-118750: Microsoft ASP.NET Core denial of service via resource allocationhighCVSS 7.5EPSS 1.1%
- CVE-2026-118749: ASP.NET Core inefficient algorithmic complexity denial of servicehighCVSS 7.5EPSS 1.1%
- CVE-2026-118748: Microsoft ASP.NET Core denial of service via resource exhaustionhighCVSS 7.5EPSS 1.1%
- CVE-2026-118747: .NET inefficient algorithmic complexity denial of servicehighCVSS 7.5EPSS 1.3%
- CVE-2026-118746: .NET framework insecure failure mode security bypassmediumCVSS 6.8
- CVE-2026-118745: Microsoft Visual Studio heap buffer overflow RCEhighCVSS 8.8EPSS 0.9%
Most severe NuGet package vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2020-16017: Use after free in CefSharpcriticalexploited in the wildCVSS 9.6EPSS 2.8%
- CVE-2020-16013: Inappropriate implementation in V8 in CefSharpcriticalexploited in the wildCVSS 8.8EPSS 2.8%
- CVE-2023-4863: RUSTSEC-2023-0060 - libwebp: OOB write in BuildHuffmanTablecriticalexploited in the wildCVSS 3.1EPSS 100.0%
- CVE-2017-9822: DNN (aka DotNetNuke) has Remote Code Execution via a cookiecriticalexploited in the wildCVSS 3.1EPSS 94.8%
- CVE-2020-1147: .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 94.0%
- CVE-2021-23758: Remote Code Execution in AjaxNetProfessionalcriticalexploited in the wildCVSS 3.1EPSS 82.6%
- CVE-2020-16009: Inappropriate implementation in V8criticalexploited in the wildCVSS 3.1EPSS 48.3%
- CVE-2020-15999: Heap buffer overflow in CefSharpcriticalexploited in the wildCVSS 3.1EPSS 44.3%
- CVE-2022-0609: Use after free in Animationcriticalexploited in the wildCVSS 3.1EPSS 22.9%
- CVE-2023-38180: .NET Denial of Service Vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 14.0%
Vulnerabilities per week
46 vulnerabilities in the last four weeks, up 92% on the four before (24). 3 critical against 2. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 10 | 1 | |
| 14 Sep 2026 | 8 | 1 | |
| 21 Sep 2026 | 4 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 12 | 1 | |
| 12 Oct 2026 | 41 | 3 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 4 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 42 | 3 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many NuGet package vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/nuget)<a href="https://junglewise.ai/threats/vendors/nuget"><img src="https://junglewise.ai/threats/vendors/nuget/badge.svg" alt="NuGet package vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/nuget.json, and this page as text at https://junglewise.ai/threats/vendors/nuget.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "NuGet package vulnerabilities", https://junglewise.ai/threats/vendors/nuget, 13 November 2026.