Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Critical	9.4	CVE-2026-88092	Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. MicrosoftMicrosoft ASP.NET Core, Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, Microsoft ASP.NET Core 10.0, Microsoft ASP.NET Core 8.0, Microsoft ASP.NET Core 9.0, Microsoft ASP.NET Core 11.0, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026	NVD	Oct 13 19:21 UTC
CVE-2026-88092Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. From the advisory Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Affects Microsoft Microsoft ASP.NET Core Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 Microsoft ASP.NET Core 10.0 Microsoft ASP.NET Core 8.0 Microsoft ASP.NET Core 9.0 Microsoft ASP.NET Core 11.0 Microsoft Visual Studio 2022 Microsoft Visual Studio 2026 NIST National Vulnerability DatabasePublished Oct 13, 2026 19:21 UTC Read the advisory
	High	7.8	CVE-2026-114148	ASP.NET Core Elevation of Privilege Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 25 14:00 UTC
CVE-2026-114148ASP.NET Core Elevation of Privilege Vulnerability Executive summary An elevation of privilege flaw affects ASP.NET Core, a Microsoft web framework. The advisory says an authorized local attacker can use it to gain higher privileges. The advisory text provided does not state a severity rating or a vendor fix recommendation. Technical summary The flaw is classed as incorrect default permissions in ASP.NET Core, which allows a local attacker who already holds some authorization to elevate privileges. The attack vector is described as local, with an authorized attacker as the precondition. Affected versions are not stated, and no fixed version is given. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 25, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-109468	ASP.NET Core Denial of Service Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 15 14:00 UTC
CVE-2026-109468ASP.NET Core Denial of Service Vulnerability From the advisory Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 15, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-70186	ASP.NET Core Denial of Service Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70186ASP.NET Core Denial of Service Vulnerability From the advisory Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-70159	ASP.NET Core Denial of Service Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70159ASP.NET Core Denial of Service Vulnerability From the advisory Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	8.1	CVE-2026-70175	ASP.NET Core Elevation of Privilege Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70175ASP.NET Core Elevation of Privilege Vulnerability From the advisory Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	Medium	5.9	CVE-2026-70196	ASP.NET Core Denial of Service Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70196ASP.NET Core Denial of Service Vulnerability From the advisory Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-70181	ASP.NET Core Denial of Service Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70181ASP.NET Core Denial of Service Vulnerability From the advisory Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-70183	ASP.NET Core Elevation of Privilege Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70183ASP.NET Core Elevation of Privilege Vulnerability From the advisory Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-70179	ASP.NET Core Elevation of Privilege Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70179ASP.NET Core Elevation of Privilege Vulnerability From the advisory Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	Critical	9.1	CVE-2026-70188	ASP.NET Core Security Feature Bypass Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-70188ASP.NET Core Security Feature Bypass Vulnerability From the advisory Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-96236	ASP.NET Core Denial of Service Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-96236ASP.NET Core Denial of Service Vulnerability From the advisory Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	Critical	9.4	CVE-2026-88092	ASP.NET Core Tampering Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-88092ASP.NET Core Tampering Vulnerability From the advisory Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	8.8	CVE-2026-96230	ASP.NET Core Remote Code Execution Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-96230ASP.NET Core Remote Code Execution Vulnerability From the advisory Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	7.5	CVE-2026-96233	ASP.NET Core Denial of Service Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-96233ASP.NET Core Denial of Service Vulnerability From the advisory Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory
	High	8.8	CVE-2026-102870	ASP.NET Core Remote Code Execution Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 13 14:00 UTC
CVE-2026-102870ASP.NET Core Remote Code Execution Vulnerability From the advisory Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 13, 2026 14:00 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects