CVE-2026-109476

Vendor

Microsoft

Product

.NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, .NET 11.0 installed on Linux

CVSS v3.1

6.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness

CWE-116

Exposure class

Developer platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 40
   Advisory MSRC 5h ago

   ASP.NET Core Information Disclosure Vulnerability

   Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

   CVE-2026-109476 Microsoft
2. 35
   CVE NVD 2h ago

   Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

   Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

   CVSS 6.1 CVE-2026-109476 Microsoft