CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 4,508 CVEs published, 321 critical, and 6 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
4,508
Show in the list
Critical, last 7 days
321
Show in the list
Healthcare-tagged, last 7 days
8
Show in the list
Known exploited (CISA KEV)
1,758
Show in the list

Showing CVEs that name the product messagepack_csharp:messagepack_csharp. Show all products

13 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-92707Medium 5.3MessagePack: Nested arrays can blow past buffer length limits
Assigned by GitHub_M
Oct 15, 2026
CVE-2026-48109High 8.2MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48502High 8.2MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48506High 7.5MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48509Medium 6.3MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48510Medium 6.3MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48511Medium 6.3MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48512Medium 6.3MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48513Medium 6.3MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement
Assigned by GitHub_M
Jun 22, 2026
CVE-2026-48514Medium 6.3MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
Assigned by GitHub_M
Jun 22, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.