HIGH: System.Security.Cryptography.Xml — Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this…
Source System.Security.Cryptography.XmlPublished 6d ago · Jul 28, 2026Posted on Threads
What we hold
- Package
- System.Security.Cryptography.Xml
- Ecosystem
- nuget
- Severity
- HIGH
- ID
- CVE-2026-32203
Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this…
More like this
HIGH: undici — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
Summary Two issues in undici's cache interceptor, both fixed by the same patch on lib/util/cache.js: 1. Shared-cache disclosure: Responses with malformed qualified Cache-Control: private directives such as private="" or private="," can be incorrectly…
HIGH: fast-uri — fast-uri vulnerable to host confusion via backslash authority introducer
Impact fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything…
CRITICAL: @nocobase/plugin-notification-in-app-message — NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal() template string with no escape, type cast, or parameter…