CVE-2026-102870High· 8.8▾ TwilightImproper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
Microsoft.AspNetCore.Components.WebAssembly.Server >= 10.0.0, <= 10.0.12Microsoft.AspNetCore.Components.WebAssembly.Server >= 11.0.0-preview.1, <= 11.0.0-rc.1Patched in:
Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.13Microsoft.AspNetCore.Components.WebAssembly.Server 11.0.0-rc.2.26478.115Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96230High· 8.8Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-105796High· 8.8Kiota is an OpenAPI based HTTP Client code generator
CVE-2021-24112High· 8.1.NET Core Remote Code Execution Vulnerability
GHSA-86xp-94pg-8r6rMedium· 5.3Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability
CVE-2026-96236High· 7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-96235High· 8.8Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.