It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3248 advisory.

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-109468)

    Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-58280)

    Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose     information over a network. (CVE-2026-66822)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-69651)

    Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70159)

    Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a     network. (CVE-2026-70175)

    Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over     a network. (CVE-2026-70179)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70181)

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET     Core allows an authorized attacker to elevate privileges over a network. (CVE-2026-70183)

    Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-70186)

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

    Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a     network. (CVE-2026-70196)

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-83520)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-84008)

    Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96225)

    Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core     allows an unauthorized attacker to execute code over a network. (CVE-2026-96230)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96231)

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96233)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-96236)

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to     execute code over a network. (CVE-2026-96237)

    Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a     network. (CVE-2026-96238)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96958)

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny     service over a network. (CVE-2026-96959)

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service     over a network. (CVE-2026-96960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a2c4eee1ec advisory.

    Update to .NET SDK 11.0.100-rc.3.26522.148 and Runtime 11.0.0-rc.3.26522.148

    Fixes: CVE-2026-102870, CVE-2026-105016, CVE-2026-111497, CVE-2026-114148, CVE-2026-58280, CVE-2026-66822,     CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162,     CVE-2026-70165, CVE-2026-70174, CVE-2026-70183, CVE-2026-70188, CVE-2026-70190, CVE-2026-70194,     CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697,     CVE-2026-88092, CVE-2026-92707, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230,     CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236,     CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

    Release Notes:
    - SDK: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.2.26504.105/11.0.100-rc.2.26504.105.md
    - SDK: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.3.26522.148/11.0.100-rc.3.26522.148.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.2.26504.105/11.0.0-rc.2.26504.105.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.3.26522.148/11.0.0-rc.3.26522.148.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

  - Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a     network. (CVE-2026-70035)

  - Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code     over a network. (CVE-2026-70174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6dc45f0579 advisory.

    Update to .NET SDK 9.0.122 and Runtime 9.0.21

    Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-     2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-2026-70179,CVE-     2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-2026-70197,CVE-     2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-2026-92707,CVE-     2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-2026-96233,CVE-     2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96958,CVE-2026-96959,CVE-     2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.21/9.0.122.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.21/9.0.21.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8cb08de43 advisory.

    Update to .NET SDK 10.0.113 and Runtime 10.0.13

    Fixes: CVE-2026-102870,CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-     2026-70035,CVE-2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-     2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-     2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-     2026-92707,CVE-2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-     2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96957,CVE-     2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.113.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a916dbb6c advisory.

    Update to .NET SDK 11.0.100-rc.3.26522.148 and Runtime 11.0.0-rc.3.26522.148

    Fixes: CVE-2026-102870, CVE-2026-105016, CVE-2026-111497, CVE-2026-114148, CVE-2026-58280, CVE-2026-66822,     CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162,     CVE-2026-70165, CVE-2026-70174, CVE-2026-70183, CVE-2026-70188, CVE-2026-70190, CVE-2026-70194,     CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697,     CVE-2026-88092, CVE-2026-92707, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230,     CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236,     CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

    Release Notes:
    - SDK: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.2.26504.105/11.0.100-rc.2.26504.105.md
    - SDK: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.3.26522.148/11.0.100-rc.3.26522.148.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.2.26504.105/11.0.0-rc.2.26504.105.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-     notes/11.0/11.0.0-rc.3.26522.148/11.0.0-rc.3.26522.148.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-87697)

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-96224, CVE-2026-96235)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c7c459ff4d advisory.

    Update to .NET SDK 10.0.113 and Runtime 10.0.13

    Fixes: CVE-2026-102870,CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-     2026-70035,CVE-2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-     2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-     2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-     2026-92707,CVE-2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-     2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96957,CVE-     2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.113.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6cdafc7e45 advisory.

    Update to .NET SDK 8.0.132 and Runtime 8.0.32

    Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-     2026-70159,CVE-2026-70162,CVE-2026-70174,CVE-2026-70175,CVE-2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-     2026-70186,CVE-2026-70188,CVE-2026-70196,CVE-2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-     2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-2026-92707,CVE-2026-96222,CVE-2026-96224,CVE-2026-96225,CVE-     2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-     2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.32/8.0.132.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.32/8.0.32.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3367 advisory.

    Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker     to execute code over a network. (CVE-2026-102870)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-109468)

    A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing     crafted Brotli input. Successful exploitation may lead to memory corruption and remote code execution.
    (CVE-2026-111497)

    Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
    (CVE-2026-114148)

    Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-58280)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-69651)

    Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70159)

    Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a     network. (CVE-2026-70175)

    Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over     a network. (CVE-2026-70179)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70181)

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET     Core allows an authorized attacker to elevate privileges over a network. (CVE-2026-70183)

    Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-70186)

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70197)

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-83520)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-84008)

    Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized     attacker to perform spoofing over a network. (CVE-2026-96222)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96225)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96231)

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96233)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-96236)

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to     execute code over a network. (CVE-2026-96237)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96958)

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny     service over a network. (CVE-2026-96959)

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service     over a network. (CVE-2026-96960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
370300	Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-3248)	Nessus	Amazon Linux Local Security Checks	2026/10/22	2026/10/30	critical
378682	Fedora 45 : dotnet11.0 (2026-a2c4eee1ec)	Nessus	Fedora Local Security Checks	2026/11/11	2026/11/12	critical
366093	Microsoft .NET Framework (October 2026)	Nessus	Windows : Microsoft Bulletins	2026/10/15	2026/10/16	high
371737	Fedora 44 : dotnet9.0 (2026-6dc45f0579)	Nessus	Fedora Local Security Checks	2026/10/24	2026/11/13	critical
371731	Fedora 44 : dotnet10.0 (2026-c8cb08de43)	Nessus	Fedora Local Security Checks	2026/10/24	2026/11/13	critical
378672	Fedora 43 : dotnet11.0 (2026-3a916dbb6c)	Nessus	Fedora Local Security Checks	2026/11/11	2026/11/12	critical
366546	Security Update for Microsoft .NET Core (October 2026)	Nessus	Windows	2026/10/16	2026/11/13	critical
371740	Fedora 43 : dotnet10.0 (2026-c7c459ff4d)	Nessus	Fedora Local Security Checks	2026/10/24	2026/11/13	critical
371923	Fedora 44 : dotnet8.0 (2026-6cdafc7e45)	Nessus	Fedora Local Security Checks	2026/10/25	2026/11/13	critical
366547	Security Update for Microsoft .NET Core SDK (October 2026)	Nessus	Windows	2026/10/16	2026/11/13	critical
374355	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3367)	Nessus	Amazon Linux Local Security Checks	2026/10/30	2026/11/2	critical

偵測

搜尋 Plugin

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical