CVE-2026-114156Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. `PathString.StartsWithSegments` can mishandle percent-encoded backslashes and permit authorization checks to match an unintended path. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/510 ## CVSS Details -…
CVE-2026-114155Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations. A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the…
CVE-2026-114150Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A reused `ResponseBufferingStream` can retain pooled tail memory and expose response-body data from another request through HTTP logging. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/514 ## CVSS Details -…
CVE-2026-114149Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume excessive resources. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511 ## CVSS Details - **Version:** 3.1 - **Severity:**…
CVE-2026-114147Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service. ## Announcement Announcement for this issue can be found at…
CVE-2026-114146Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim. ## Announcement Announcement for this issue can be found at…
CVE-2026-109481Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. The Blazor/SignalR `/_blazor/refresh` path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/506 ##…
CVE-2026-109478Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Processing comma-separated HTTP header values can cause excessive allocations and resource exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/515 ## CVSS Details - **Version:** 3.1 - **Severity:**…
CVE-2026-109476Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A crafted `X-Forwarded-Prefix` can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508 ## CVSS Details -…
CVE-2026-109475Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Managed `HttpListener` can recursively process an unterminated request line and exhaust the process stack. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/500 ## CVSS Details - **Version:** 3.1 - **Severity:** High -…
CVE-2026-105544Microsoft Visual Studio 2022, Red Hat Enterprise Linux, Microsoft ASP.NET, Microsoft Azure DevOps Server, Microsoft…10. Nov 2026
dotnet11.0: dotnet10.0: dotnet9.0: dotnet8.0: .NET Elevation of Privilege Vulnerability
CVE-2026-121885Red Hat Enterprise Linux, Open Source Podman10. Nov 2026
podman: Untrusted image labels allow auto-update to restart arbitrary systemd units
CVE-2026-124952Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
CVE-2026-124950Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Same-origin policy bypass in the CSS Parsing and Computation component
CVE-2026-124949Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
CVE-2026-124947Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Incorrect boundary conditions in the Graphics component
CVE-2026-124946Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Invalid pointer in the JavaScript Engine: JIT component
CVE-2026-124945Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component
CVE-2026-124944Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Information disclosure in the Marionette component
CVE-2026-124943Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Use-after-free in the Layout component
CVE-2026-124937Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: Other issue in the Media component in Firefox for Android
CVE-2026-124936Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Spoofing issue in the Address Bar component
CVE-2026-124928Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Mitigation bypass in the SVG component
CVE-2026-124925Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Information disclosure in the Layout component
CVE-2026-124923Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Sandbox escape in the Agent component
CVE-2026-124921Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Sandbox escape in the Graphics: WebGPU component
CVE-2026-124920Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Uninitialized memory in the Graphics: WebGPU component
CVE-2026-124911Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: Clickjacking issue in the Autofill component in Firefox for Android
CVE-2026-124908Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component
CVE-2026-124904Red Hat Enterprise Linux, SUSE Linux, Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird10. Nov 2026
firefox: thunderbird: Use-after-free in the SVG component