NF
Product
.NET Framework
On CISA KEVExploited in the wild
207
CVEs
5
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 7High 91Medium 15Low 1
Watch
Add .NET Framework to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50659 | 6.5 | Jul 14 | .NET Spoofing Vulnerability Affected: 4.8.1; 4.8; 4.6.2; 4.7; 4.7.1; 4.7.2; +7 more |
| CVE-2019-11397 | 6.5 | May 14 | GetFile.aspx in Rapid4 RapidFlows Enterprise Application Builder 4.5M.23 (when used with .NET Framework 4.5) allows Local File Inclusion via the FileDesc parameter Affected: 4.5 |
| CVE-2026-32226 | 5.9 | Apr 14 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 4.7.2; 3.5; 4.8; 4.8; 3.5; +1 more |
| CVE-2023-36873 | 5.9 | Aug 8 | .NET Framework Spoofing Vulnerability Affected: 4.6.2; 3.5; 4.8.1; 4.6.2; 4.7; 4.7.1; +6 more |
| CVE-2019-0657 | 5.9 | Mar 5 | A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +19 more |
| CVE-2016-0149 | 5.9 | May 11 | Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving… Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +1 more |
| CVE-2022-41064 | 5.8 | Nov 9 | .NET Framework Information Disclosure Vulnerability Affected: 4.8; 4.8.1; 4.6.2; 4.6.2; 4.7; 4.7.1; +33 more |
| CVE-2025-55248 | 5.7 | Oct 14 | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network Affected: 4.6.2; 4.7; 4.7.1; 4.7.2; 4.6.2; 3.5.1; +9 more |
| CVE-2020-1476 | 5.5 | Aug 17 | An elevation of privilege vulnerability exists when ASP.NET or .NET web applications running on IIS improperly allow access to cached files Affected: 2.0; 3.5; 3.5; 4.6.2; 4.7; 4.7.1; +22 more |
| CVE-2019-1142 | 5.5 | Sep 11 | An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of… Affected: 3.5; 3.5; 4.7.2; 4.6; 4.6.1; 4.6.2; +7 more |
| CVE-2019-0864 | 5.5 | May 16 | A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of Service Vulnerability' Affected: 2.0; 3.0; 3.5; 3.5.1; 4.5.2; 4.6; +18 more |
| CVE-2018-8356 | 5.5 | Jul 11 | A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass… Affected: 3.0; 3.5; 3.5.1; 4.5.2; 4.6; 4.6.2; +13 more |
| CVE-2016-3209 | 5.5 | Oct 14 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2;… Affected: 3.0; 3.5; 3.5.1; 4.5.2; 4.6 |
| CVE-2023-21722 | 5.0 | Feb 14 | .NET Framework Denial of Service Vulnerability Affected: 3.5; 4.7.2; 3.5; 4.8; 3.5; 4.8.1; +12 more |
| CVE-2020-16937 | 4.7 | Oct 16 | <p>An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory Affected: 2.0; 3.5; 3.5; 4.6.2; 4.7; 4.7.1; +22 more |
Showing 15