CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,113 CVEs published, 238 critical, and 6 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,113
Show in the list
Critical, last 7 days
238
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,758
Show in the list

Showing CVEs that name the product messagepack_csharp:messagepack_csharp. Show all products

13 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-48517Medium 6.3MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48516Medium 6.3MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48515Medium 6.3MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48514Medium 6.3MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48513Medium 6.3MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48512Medium 6.3MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48511Medium 6.3MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48510Medium 6.3MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48509Medium 6.3MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48506High 7.5MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
Assigned by GitHub_M
Jun 22, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.