CVE Vulnerability Catalog

A vulnerability in .NET due to improper verification of cryptographic signature allows an unauthorized attacker to bypass a security feature over a network.

ASP.NET Core has an authentication bypass vulnerability due to assumed-immutable data. This allows an authorized attacker to elevate privileges over a network.

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to remotely cause a denial of service (DoS).

An improper access control vulnerability in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. The flaw can be exploited remotely by an authenticated user.

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

A vulnerability in the Yaml component of the Symfony framework allows a ReDoS (Regular Expression Denial of Service) attack via crafted YAML input. The `cleanup()` method in the `Parser` class uses regular expressions with overlapping quantifiers, which can cause parsing to hang for an arbitrarily long time.

A vulnerability in the Symfony Yaml component allows a YAML bomb attack via recursive expansion of collection aliases. A small untrusted YAML input can be expanded into a multi-gigabyte structure, exhausting memory.

A vulnerability in Symfony allows a DoS attack via deeply nested YAML structures. The lack of recursion depth limit in the parser causes PHP stack exhaustion and worker crash.

In Symfony prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes configured for GET only are skipped for HEAD requests, allowing protected controllers to execute and potentially leak headers or perform side effects.

A vulnerability in Symfony's PdoAdapter allows an attacker to manipulate a DELETE statement by improperly handling the prefix. The lack of proper binding or escaping enables altering query semantics and deletion scope.

In Open5GS up to version 2.7.7, a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

An improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request by directly calling the request status endpoint, bypassing the required approver review.

An improper authorization vulnerability in Devolutions Server allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. The issue affects the PAM SSH key and certificate retrieval endpoints.

Use-After-Free vulnerability in Windows Client-Side Caching (CSC) Service. Allows an authorized attacker to elevate privileges locally.

A Use-After-Free vulnerability in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

A Use-After-Free vulnerability in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

A use-after-free vulnerability in Windows Win32K allows an authorized attacker to elevate privileges locally.

Use-After-Free vulnerability in Windows DirectX. Allows an authorized attacker to elevate privileges locally.

Race condition vulnerability in Windows Wireless Networking service that allows an authorized attacker to elevate privileges locally.

An unauthorized attacker can cause uncontrolled resource consumption in the Windows DHCP Server, leading to a denial of service (DoS) over the network. The vulnerability stems from a lack of limits in processing certain DHCP requests.