Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

CVE-2026-50528

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

CVE-2026-50648

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

CVE-2026-50524

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

CVE-2026-47304

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

CVE-2026-47302

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

CVE-2026-57108

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the

历史摘要 · 未重新核验 · GitHub Advisory

AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

CVE-2026-54570

### Summary The HTML specification requires that a MathML `` element with `encoding="text/html"` or `encoding="applicati

历史摘要 · 未重新核验 · GitHub Advisory

Prompty: Arbitrary file read via file reference expansion

CVE-2026-53598

## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolv

历史摘要 · 未重新核验 · GitHub Advisory

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

CVE-2026-50273

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without

历史摘要 · 未重新核验 · GitHub Advisory

Umbraco.AI discloses sensitive application configuration values

### Impact Under certain configurations, a user with elevated privileges may be able to cause sensitive application conf

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

CVE-2026-50268

### Summary Configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Due to an incorrect BouncyCastle

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

CVE-2026-50267

### Summary When MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connecto

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe's static JWKS cache shared across schemes and never invalidated

CVE-2026-50202

### Summary The JWT signing key cache in `TokenKeyResolver` uses `kid` as the sole cache key without namespacing by aut

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

CVE-2026-50201

### Summary All Steeltoe actuator endpoints default to `EndpointPermissions.Restricted`, which is mapped to Cloud Found

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

CVE-2026-50200

### Summary The `Sanitizer` component in the Environment actuator redacts configuration values by matching the configur

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

CVE-2026-50196

### Summary `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

CVE-2026-50194

### Summary When Steeltoe management endpoints are configured to listen on an alternate port (`Management:Endpoints:Por

历史摘要 · 未重新核验 · GitHub Advisory

CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

CVE-2026-48796

### Summary `FolderSchemeHandlerFactory` was intended to restrict served files to a configured `rootFolder`, but its pa

历史摘要 · 未重新核验 · GitHub Advisory

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

CVE-2026-53465

An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder.

历史摘要 · 未重新核验 · GitHub Advisory

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

CVE-2026-53464

When providing invalid options to the wand option parser a small memory leak will occur.

历史摘要 · 未重新核验 · GitHub Advisory