NF
Product
.NET Framework
On CISA KEVExploited in the wild
207
CVEs
5
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 7High 91Medium 15Low 1
Watch
Add .NET Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96960 | 7.5 | Oct 13 | .NET Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +12 more |
| CVE-2026-96959 | 7.5 | Oct 13 | .NET Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +12 more |
| CVE-2026-96958 | 7.5 | Oct 13 | .NET Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +12 more |
| CVE-2026-50648 | 7.5 | Jul 14 | .NET Framework Denial of Service Vulnerability Affected: 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; 3.5; +6 more |
| CVE-2026-50527 | 7.5 | Jul 14 | .NET Framework Denial of Service Vulnerability Affected: 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; 3.5; +6 more |
| CVE-2026-50525 | 7.5 | Jul 14 | .NET Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +7 more |
| CVE-2026-47302 | 7.5 | Jul 14 | .NET Denial of Service Vulnerability Affected: 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; 3.5; +6 more |
| CVE-2026-50647 | 7.5 | Jul 14 | Active Directory Federation Server Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +6 more |
| CVE-2026-50411 | 7.5 | Jul 14 | Windows Active Directory Federation Services Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +6 more |
| CVE-2026-50355 | 7.5 | Jul 14 | Windows Active Directory Federation Services Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +6 more |
| CVE-2026-50368 | 7.5 | Jul 14 | Windows Active Directory Federation Services Denial of Service Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +6 more |
| CVE-2026-50653 | 7.5 | Jul 14 | Azure Active Directory Denial of Service Vulnerability Affected: 3.5; 4.8.1; 4.6.2; 4.7; 4.7.1; 4.7.2; +1 more |
| CVE-2026-50652 | 7.5 | Jul 14 | Azure Active Directory Denial of Service Vulnerability Affected: 3.5; 4.8.1; 4.6.2; 4.7; 4.7.1; 4.7.2; +1 more |
| CVE-2026-23666 | 7.5 | Apr 14 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 3.5; 4.7.2; 3.5; 4.8; 3.5; +6 more |
| CVE-2026-33116 | 7.5 | Apr 14 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability Affected: 3.5; 3.5; 4.7.2; 4.6.2; 4.7; 4.7.1; +6 more |
| CVE-2024-43484 | 7.5 | Oct 8 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability Affected: 3.5; 4.8.1; 3.5; 4.8; 3.5; 4.8; +12 more |
| CVE-2024-43483 | 7.5 | Oct 8 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability Affected: 3.5; 4.8.1; 3.5; 4.8; 3.5; 4.8; +12 more |
| CVE-2024-21312 | 7.5 | Jan 9 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 3.5; 4.8.1; 4.6.2; 4.7; 4.7.1; +6 more |
| CVE-2023-32030 | 7.5 | Jun 14 | .NET and Visual Studio Denial of Service Vulnerability Affected: 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; 4.6.2; +17 more |
| CVE-2023-29331 | 7.5 | Jun 14 | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability Affected: 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; 4.6.2; +17 more |
| CVE-2023-24936 | 7.5 | Jun 14 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability Affected: 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; 4.6.2; +17 more |
| CVE-2022-26832 | 7.5 | Apr 15 | .NET Framework Denial of Service Vulnerability Affected: 2.0; 3.0; 3.5; 3.5; 4.7.2; 3.5; +11 more |
| CVE-2022-21911 | 7.5 | Jan 11 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 4.7.2; 3.5; 4.6.2; 4.7; 4.7.1; +34 more |
| CVE-2021-24111 | 7.5 | Feb 25 | .NET Framework Denial of Service Vulnerability Affected: 4.6; 4.6.2; 4.7; 4.7.1; 4.7.2; 4.6; +7 more |
| CVE-2020-1108 | 7.5 | May 21 | A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests Affected: 2.0; 3.0; 4.6; 3.5; 3.5; 4.5.2; +34 more |
| CVE-2019-1083 | 7.5 | Jul 15 | A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests, aka '.NET Denial of Service Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5; 4.7.2; 3.5; +16 more |
| CVE-2019-1006 | 7.5 | Jul 15 | An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary… Affected: 2.0; 3.0; 3.5; 3.5; 4.7.2; 3.5; +14 more |
| CVE-2019-0981 | 7.5 | May 16 | A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +18 more |
| CVE-2019-0980 | 7.5 | May 16 | A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +18 more |
| CVE-2019-0820 | 7.5 | May 16 | A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +18 more |
| CVE-2019-0545 | 7.5 | Jan 8 | An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework… Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6.2; +15 more |
| CVE-2018-8517 | 7.5 | Dec 12 | A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framework Denial Of Service Vulnerability." This affects Microsoft… Affected: 3.5; 3.5; 3.5.1; 4.5.2; 4.6.2; 4.6; +4 more |
| CVE-2018-8360 | 7.5 | Aug 15 | An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka ".NET Framework… Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6.2; +15 more |
| CVE-2018-0765 | 7.5 | May 9 | A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft… Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +15 more |
| CVE-2018-0786 | 7.5 | Jan 10 | Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass… Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +9 more |
| CVE-2018-0764 | 7.5 | Jan 10 | Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0 Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +9 more |
| CVE-2017-8585 | 7.5 | Jul 11 | Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial… Affected: 4.6; 4.6.1; 4.6.2; 4.7 |
| CVE-2017-0248 | 7.5 | May 12 | Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is… Affected: 2.0; 3.5; 3.5.1; 4.5.2; 4.6; 4.6.1; +2 more |
| CVE-2016-7270 | 7.5 | Dec 20 | The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encrypted protection… Affected: 4.6.2 |
| CVE-2016-3255 | 7.5 | Jul 13 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in… Affected: 2.0; 3.5; 3.5.1; 4.5.2; 4.6; 4.6.1 |
| CVE-2016-0047 | 7.5 | Feb 10 | WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via crafted icon data,… Affected: 2.0; 3.5; 3.5.1; 4.5.2; 4.6; 4.6.1 |
| CVE-2016-0033 | 7.5 | Feb 10 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to cause a denial of… Affected: 2.0; 3.5; 3.5.1; 4.5.2; 4.6; 4.6.1 |
| CVE-2026-96222 | 7.4 | Oct 13 | Active Directory Federation Services (AD FS) Spoofing Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +10 more |
| CVE-2026-35433 | 7.3 | May 12 | .NET Elevation of Privilege Vulnerability Affected: 4.8; 3.5; 3.5; 4.8.1; 3.5; 4.8; +2 more |
| CVE-2026-32177 | 7.3 | May 12 | .NET Elevation of Privilege Vulnerability Affected: 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; 3.5; +4 more |
| CVE-2024-38081 | 7.3 | Jul 9 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability Affected: 4.6.2; 4.7; 4.7.1; 4.7.2; 3.5; 4.8; +8 more |
| CVE-2024-21409 | 7.3 | Apr 9 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability Affected: 3.5; 4.8.1; 3.5; 4.7.2; 4.8; 4.6.2; +6 more |
| CVE-2026-62897 | 7.0 | Aug 11 | .NET Framework Remote Code Execution Vulnerability Affected: 3.5; 3.5; 4.7.2; 4.8.1; 3.5; 4.8 |
| CVE-2026-50659 | 6.5 | Jul 14 | .NET Spoofing Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +7 more |
| CVE-2019-11397 | 6.5 | May 14 | GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc parameter Affected: 4.5 |