https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 05:52:16 +0000 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1316 certfr-2026-avi-1316 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1316 https://vulnerability.circl.lu/vuln/fkie_cve-2026-96230 <p>Improper neutralization of input during web page generation (&#39;cross-site scripting&#39;) in ASP.NET Core allows an unauthorized attacker to execute code over a network.</p> <p>Improper neutralization of input during web page generation (&#39;cross-site scripting&#39;) in ASP.NET Core allows an unauthorized attacker to execute code over a network.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-96230 https://vulnerability.circl.lu/vuln/ghsa-qjpx-jqm5-h2c4 <p><strong>Affected:</strong> NuGet: Microsoft.AspNetCore.Components.WebAssembly.Server</p> <p>## Executive summary</p> <p>Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.</p> <p>The Blazor WebAssembly development-server debug page can reflect unencoded exception text, allowing cross-origin script injection through the unauthenticated `/_framework/debug` endpoint used by `dotnet watch`.</p> <p>## Announcement</p> <p>Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/478</p> <p>## CVSS Details</p> <p>- **Version:** 3.1 - **Severity:** High - **Score:** 8.8 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` - **Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;))</p> <p>## Affected Platforms</p> <p>- **Platforms:** Windows, Linux, macOS - **Architectures:** All</p> <p>## &lt;a name=&#34;affected-packages&#34;&gt;&lt;/a&gt;Affected Packages</p> <p>The vulnerability affects Microsoft .NET projects that use an affected package version listed below.</p> <p>Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | &gt;= 10.0.0, &lt;= 10.0.12 | 10.0.13 [Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAsse…</p> <p><strong>Affected:</strong> NuGet: Microsoft.AspNetCore.Components.WebAssembly.Server</p> <p>## Executive summary</p> <p>Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.</p> <p>The Blazor WebAssembly development-server debug page can reflect unencoded exception text, allowing cross-origin script injection through the unauthenticated `/_framework/debug` endpoint used by `dotnet watch`.</p> <p>## Announcement</p> <p>Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/478</p> <p>## CVSS Details</p> <p>- **Version:** 3.1 - **Severity:** High - **Score:** 8.8 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` - **Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;))</p> <p>## Affected Platforms</p> <p>- **Platforms:** Windows, Linux, macOS - **Architectures:** All</p> <p>## &lt;a name=&#34;affected-packages&#34;&gt;&lt;/a&gt;Affected Packages</p> <p>The vulnerability affects Microsoft .NET projects that use an affected package version listed below.</p> <p>Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | &gt;= 10.0.0, &lt;= 10.0.12 | 10.0.13 [Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAsse…</p> https://vulnerability.circl.lu/vuln/ghsa-qjpx-jqm5-h2c4 https://vulnerability.circl.lu/vuln/ncsc-2026-0426 NCSC-2026-0426 https://vulnerability.circl.lu/vuln/ncsc-2026-0426