NF
Product
.NET Framework
On CISA KEVExploited in the wild
207
CVEs
5
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 7High 91Medium 15Low 1
Watch
Add .NET Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-32226 | 5.9 | Apr 14 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 4.7.2; 3.5; 4.8; 4.8; 3.5; +1 more |
| CVE-2023-36873 | 5.9 | Aug 8 | .NET Framework Spoofing Vulnerability Affected: 4.6.2; 3.5; 4.8.1; 4.6.2; 4.7; 4.7.1; +6 more |
| CVE-2019-0657 | 5.9 | Mar 5 | A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +19 more |
| CVE-2016-0149 | 5.9 | May 11 | Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving… Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +1 more |
| CVE-2022-41064 | 5.8 | Nov 9 | .NET Framework Information Disclosure Vulnerability Affected: 4.8; 4.8.1; 4.6.2; 4.6.2; 4.7; 4.7.1; +33 more |
| CVE-2025-55248 | 5.7 | Oct 14 | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network Affected: 4.6.2; 4.7; 4.7.1; 4.7.2; 4.6.2; 3.5.1; +9 more |
| CVE-2020-1476 | 5.5 | Aug 17 | An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files Affected: 2.0; 3.5; 3.5; 4.6.2; 4.7; 4.7.1; +22 more |
| CVE-2019-1142 | 5.5 | Sep 11 | An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of… Affected: 3.5; 3.5; 4.7.2; 4.6; 4.6.1; 4.6.2; +7 more |
| CVE-2019-0864 | 5.5 | May 16 | A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of Service Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +18 more |
| CVE-2018-8356 | 5.5 | Jul 11 | A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass… Affected: 3.0; 3.5; 3.5.1; 4.5.2; 4.6; 4.6.2; +13 more |
| CVE-2016-3209 | 5.5 | Oct 14 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2;… Affected: 3.0; 3.5; 3.5.1; 4.5.2; 4.6 |
| CVE-2023-21722 | 5.0 | Feb 14 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 4.7.2; 3.5; 4.8; 3.5; 4.8.1; +12 more |
| CVE-2020-16937 | 4.7 | Oct 16 | <p>An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory Affected: 2.0; 3.5; 3.5; 4.6.2; 4.7; 4.7.1; +22 more |
| CVE-2022-30130 | 3.3 | May 10 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 4.6.2; 4.7; 4.7.1; 4.7.2; 4.8; +34 more |
| CVE-2015-6108 | – | Dec 9 | The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT… Affected: 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 4.6; +2 more |
| CVE-2015-6115 | – | Nov 11 | Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka ".NET ASLR Bypass." Affected: 2.0; 3.5; 3.5.1 |
| CVE-2015-6099 | – | Nov 11 | Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to inject arbitrary web script or HTML via a… Affected: 4.0; 4.5; 4.5.1; 4.5.2; 4.6 |
| CVE-2015-6096 | – | Nov 11 | The XML DTD parser in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to read arbitrary files via an external entity… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5; 4.5.1; +2 more |
| CVE-2015-2526 | – | Sep 9 | Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted requests, aka "MVC Denial of Service… Affected: 4.5; 4.5.1; 4.5.2; 4.6 |
| CVE-2015-2504 | – | Sep 9 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5; 4.5.1; +2 more |
| CVE-2015-2481 | – | Aug 15 | The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a… Affected: 4.6 |
| CVE-2015-2480 | – | Aug 15 | The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a… Affected: 4.6 |
| CVE-2015-2479 | – | Aug 15 | The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a… Affected: 4.6 |
| CVE-2015-2464 | – | Aug 15 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3… Affected: 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 4.6; +2 more |
| CVE-2015-2463 | – | Aug 15 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3… Affected: 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 4.6; +2 more |
| CVE-2015-2462 | – | Aug 15 | ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012… Affected: 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 4.6; +2 more |
| CVE-2015-2460 | – | Aug 15 | ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012… Affected: 3.5; 3.5.1; 3.0; 4.0; 4.5; 4.5.1; +2 more |
| CVE-2015-2456 | – | Aug 15 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10,… Affected: 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 4.6; +2 more |
| CVE-2015-2455 | – | Aug 15 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10,… Affected: 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 4.6; +2 more |
| CVE-2015-2435 | – | Aug 15 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10,… Affected: 3.0; 4.0; 4.5; 4.5.1; 4.5.2; 4.6; +2 more |
| CVE-2015-1673 | – | May 13 | The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute… Affected: 1.1; 2.0; 3.5; 3.5.1; 4.0; 4.5; +2 more |
| CVE-2015-1672 | – | May 13 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5; 4.5.1; +1 more |
| CVE-2015-1670 | – | May 13 | The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from… Affected: 3.0; 3.5; 3.5.1; 4.0; 4.5; 4.5.1; +1 more |
| CVE-2015-1648 | – | Apr 14 | ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain… Affected: 1.1; 2.0; 3.5; 3.5.1; 4.0; 4.5; +2 more |
| CVE-2014-4149 | – | Nov 11 | Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allows remote attackers to execute… Affected: 1.1; 2.0; 3.5; 3.5.1; 4.0; 4.5; +2 more |
| CVE-2014-4122 | – | Oct 15 | Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 omits the ASLR protection mechanism, which allows remote attackers to obtain potentially sensitive information about memory… Affected: 2.0; 3.5; 3.5.1 |
| CVE-2014-4121 | – | Oct 15 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized resource identifiers, which allows remote attackers to execute… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5; 4.5.1; +1 more |
| CVE-2014-4073 | – | Oct 15 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 processes unverified data during interaction with the ClickOnce installer, which allows remote attackers to… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5; 4.5.1; +1 more |
| CVE-2014-4072 | – | Sep 10 | Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly use a hash table for request data, which allows remote attackers to… Affected: 1.1; 2.0; 3.0; 3.5; 3.5.1; 4.0; +3 more |
| CVE-2014-4062 | – | Aug 12 | Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, and 3.5.1 does not properly implement the ASLR protection mechanism, which allows remote attackers to obtain sensitive… Affected: 1.1; 2.0; 3.0; 3.5; 3.5.1 |
| CVE-2014-1806 | – | May 14 | The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, which allows remote… Affected: 1.1; 2.0; 3.5; 3.5.1; 4.0; 4.5; +1 more |
| CVE-2014-0295 | – | Feb 12 | VsaVb7rt.dll in Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not implement the ASLR protection mechanism, which makes it easier for remote attackers to execute arbitrary code… Affected: 2.0; 3.5.1 |
| CVE-2014-0257 | – | Feb 12 | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers… Affected: 1.0; 1.1; 2.0; 3.5; 3.5.1; 4.0; +2 more |
| CVE-2014-0253 | – | Feb 12 | Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to cause a denial of… Affected: 1.1; 2.0; 3.5; 3.5.1; 4.0; 4.5; +1 more |
| CVE-2013-3861 | – | Oct 9 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences… Affected: 2.0; 3.5; 3.5; 3.5.1; 4.0; 4.5 |
| CVE-2013-3860 | – | Oct 9 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly parse a DTD during XML digital-signature validation, which allows remote attackers to cause a… Affected: 2.0; 3.5; 3.5; 3.5.1; 4.0; 4.5 |
| CVE-2013-3128 | – | Oct 9 | The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows… Affected: 3.0; 3.5; 3.5.1; 4.0; 4.5 |
| CVE-2013-3171 | – | Jul 10 | The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows… Affected: 2.0; 3.5; 3.5; 3.5.1; 4.0; 4.5 |
| CVE-2013-3134 | – | Jul 10 | The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 on 64-bit platforms does not properly allocate arrays of structures, which allows… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5 |
| CVE-2013-3133 | – | Jul 10 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check the permissions of objects that use reflection, which allows remote attackers to execute arbitrary… Affected: 2.0; 3.5; 3.5.1; 4.0; 4.5 |