AC
Product
Asp.net Core
On CISA KEVExploited in the wild
41
CVEs
2
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 3High 31Medium 7Low 0
Watch
Add Asp.net Core to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: 6.0.0 before 6.0.23; 7.0.0 before 7.0.12 |
| CVE-2023-38180 In wildKEV | 7.5 | Aug 8 | .NET and Visual Studio Denial of Service Vulnerability Affected: 2.1 before 2.1.40 |
| CVE-2025-55315 | 9.9 | Oct 14 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network Affected: 2.3.0 before 2.3.6; 8.0.0 before 8.0.21; 9.0.0 before 9.0.10 |
| CVE-2026-88092 | 9.4 | Oct 13 | ASP.NET Core Tampering Vulnerability Affected: 8.0.0 before 8.0.32; 9.0.0 before 9.0.21; 10.0.0 before 10.0.13; after 11.0.0 and later; 11.0 |
| CVE-2026-40372 | 9.1 | Apr 21 | ASP.NET Core Elevation of Privilege Vulnerability Affected: 10.0.0 before 10.0.7 |
| CVE-2021-43877 | 8.8 | Dec 15 | ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability Affected: 3.1; 5.0; 6.0 |
| CVE-2020-0603 | 8.8 | Jan 14 | A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability… Affected: 2.1; 3.0; 3.1 |
| CVE-2019-1302 | 8.8 | Sep 11 | An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka… Affected: 2.1; 2.2; 3.0 |
| CVE-2018-0787 | 8.8 | Mar 14 | ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core… Affected: 1.0; 1.1; 2.0 |
| CVE-2018-0784 | 8.8 | Jan 10 | ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Elevation Of Privilege Vulnerability".… Affected: 2.0 |
| CVE-2017-11879 | 8.8 | Nov 15 | ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of… Affected: 2.0 |
| CVE-2026-45591 | 7.5 | Jun 9 | ASP.NET Core Denial of Service Vulnerability Affected: 8.0.0 before 8.0.28; 9.0.0 before 9.0.17; 10.0.0 before 10.0.9 |
| CVE-2026-26130 | 7.5 | Mar 10 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network Affected: 8.0.0 before 8.0.25; 9.0.0 before 9.0.14; 10.0.0 before 10.0.4 |
| CVE-2025-26682 | 7.5 | Apr 8 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network Affected: 8.0.0 before 8.0.15; 9.0.0 before 9.0.4 |
| CVE-2024-21404 | 7.5 | Feb 13 | .NET Denial of Service Vulnerability Affected: 6.0.0 before 6.0.27; 7.0.0 before 7.0.16; 8.0.0 before 8.0.2 |
| CVE-2024-21386 | 7.5 | Feb 13 | .NET Denial of Service Vulnerability Affected: 6.0.0 before 6.0.27; 7.0.0 before 7.0.16; 8.0.0 before 8.0.2 |
| CVE-2023-36038 | 7.5 | Nov 14 | ASP.NET Core Denial of Service Vulnerability Affected: 8.0.0 |
| CVE-2023-35391 | 7.5 | Aug 8 | ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability Affected: 2.1 before 2.1.40 |
| CVE-2021-1723 | 7.5 | Jan 12 | ASP.NET Core and Visual Studio Denial of Service Vulnerability Affected: 3.1 through 3.1.10; 5.0 through 5.0.1 |
| CVE-2020-1045 | 7.5 | Sep 11 | <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie… Affected: 2.1 through 2.1.21; 3.1 before 3.1.8 |
| CVE-2020-1597 | 7.5 | Aug 17 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests Affected: 2.1; 3.1 |
| CVE-2020-1161 | 7.5 | May 21 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests Affected: 3.1 |
| CVE-2020-0602 | 7.5 | Jan 14 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability' Affected: 2.1; 3.0; 3.1 |
| CVE-2019-0982 | 7.5 | May 16 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability' Affected: 2.1; 2.2 |
| CVE-2019-0815 | 7.5 | Apr 9 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability' Affected: 2.2 |
| CVE-2019-0564 | 7.5 | Jan 8 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1 Affected: 2.1 |
| CVE-2019-0548 | 7.5 | Jan 8 | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2,… Affected: 2.1; 2.2 |
| CVE-2018-8292 | 7.5 | Oct 10 | An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure… Affected: 1.0; 1.1; 2.1 |
| CVE-2018-8409 | 7.5 | Sep 13 | A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1,… Affected: 2.1 before 2.1.4 |
| CVE-2018-8171 | 7.5 | Jul 11 | A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This… Affected: 1.0; 1.1; 2.0 |
| CVE-2018-0875 | 7.5 | Mar 14 | .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core… Affected: 1.0; 1.1; 2.0 |
| CVE-2018-0808 | 7.5 | Mar 14 | ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevation Of Privilege… Affected: 1.0; 1.1; 2.0 |
| CVE-2017-8700 | 7.5 | Nov 15 | ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka… Affected: 1.0; 1.1; 2.0 |
| CVE-2025-24070 | 7.0 | Mar 11 | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network Affected: 8.0.0 before 8.0.14; 9.0.0 before 9.0.3 |
| CVE-2018-8416 | 6.5 | Nov 14 | A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1 Affected: 2.1 |
| CVE-2018-0785 | 6.5 | Jan 10 | ASP.NET Core 1.0. 1.1, and 2.0 allow a cross site request forgery vulnerability due to the ASP.NET Core project templates, aka "ASP.NET Core Cross Site Request Forgery… Affected: 2.0 |
| CVE-2019-1075 | 6.1 | Jul 15 | A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability' Affected: 2.1; 2.2 |
| CVE-2026-69304 | 5.9 | Sep 8 | ASP.NET Core Denial of Service Vulnerability Affected: 8.0.0 before 8.0.28; 9.0.0 before 9.0.17; 10.0.0 before 10.0.9; after 11.0.0 and later; 11.0 |
| CVE-2023-36558 | 5.5 | Nov 14 | ASP.NET Core Security Feature Bypass Vulnerability Affected: 6.0.0 before 6.0.25; 7.0.0 before 7.0.14; 8.0.0 |
| CVE-2021-34532 | 5.5 | Aug 12 | ASP.NET Core and Visual Studio Information Disclosure Vulnerability Affected: 2.1 through 2.1.2; 3.1 through 3.1.17; 5.0 through 5.0.8 |
| CVE-2018-8356 | 5.5 | Jul 11 | A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass… Affected: 1.0; 1.1; 2.0 |
Showing 41
