The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_86195 advisory.

    * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)

    * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)

    * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)

    * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability     (CVE-2026-70183)

    * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)

    * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)

    * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits     (CVE-2026-92707)

    * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)

    * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability     (CVE-2026-96230)

    * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)

    * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)

    * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)

    * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)

    * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)

    Bug Fix(es) and Enhancement(s):

    * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [rhel-10.2.z] (JIRA:Rocky Linux-277809)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_86193 advisory.

    * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)

    * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)

    * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)

    * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability     (CVE-2026-70183)

    * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)

    * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)

    * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits     (CVE-2026-92707)

    * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)

    * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability     (CVE-2026-96230)

    * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)

    * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)

    * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)

    * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)

    * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)

    Bug Fix(es) and Enhancement(s):

    * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [rhel-9.8.z] (JIRA:Rocky Linux-277808)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2163:22 advisory.

    * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
      * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
      * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
      * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
      * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-70159)
      * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
      * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
      * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
      * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability     (CVE-2026-70183)
      * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
      * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
      * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
      * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
      * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length     limits (CVE-2026-92707)
      * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
      * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability     (CVE-2026-96230)
      * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
      * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-96233)
      * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-96236)
      * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
      * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
      * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-86192 advisory.

    [10.0.114-1.0.2]
    - Add support for Oracle Linux
    - build dotnet-host

    [10.0.114-1]
    - Update to .NET SDK 10.0.114 and Runtime 10.0.14
    - Resolves: RHEL-291741

    [10.0.113-2]
    - Update to .NET SDK 10.0.113 and Runtime 10.0.13
    - Resolves: RHEL-277805

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8958-1 advisory.

    It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An     attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally     released via USN-8942-1, but it was found to be incomplete. This issue only affected dotnet10 and     dotnet11. (CVE-2026-102870)

    It was discovered that the Brotli decompression library used by .NET incorrectly handled certain     compressed streams. A remote attacker could possibly use this issue to cause a denial of service or     execute arbitrary code. (CVE-2026-111497)

    Alen Cheung discovered that .NET did not properly handle file ownership in certain circumstances. An     attacker could possibly use this issue to elevate local privileges. (CVE-2026-114148)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:86192 advisory.

    * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
      * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
      * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
      * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
      * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-70159)
      * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
      * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
      * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
      * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability     (CVE-2026-70183)
      * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
      * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
      * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
      * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
      * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length     limits (CVE-2026-92707)
      * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
      * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability     (CVE-2026-96230)
      * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
      * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-96233)
      * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-96236)
      * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
      * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
      * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)


    Bug Fix(es) and Enhancement(s):

      * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 (JIRA:AlmaLinux-277805)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:86193 advisory.

    .NET is a fast, lightweight and modular platform for creating cross platform applications that work on     Linux, macOS and Windows.  It particularly focuses on creating console applications, web applications and     micro-services.  .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK     containing compilers and a 'dotnet' application to drive everything.

    SDK version: 10.0.113     Runtime version: 10.0.13

    Security Fix(es):

    * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)

    * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)

    * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)

    * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability     (CVE-2026-70183)

    * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)

    * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)

    * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits     (CVE-2026-92707)

    * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)

    * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability     (CVE-2026-96230)

    * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)

    * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)

    * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)

    * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)

    * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)

    Bug Fix(es) and Enhancement(s):

    * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [rhel-9.8.z] (JIRA:RHEL-277808)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86195 advisory.

    * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)

    * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)

    * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)

    * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)

    * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability     (CVE-2026-70183)

    * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)

    * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)

    * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)

    * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)

    * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits     (CVE-2026-92707)

    * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)

    * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability     (CVE-2026-96230)

    * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)

    * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)

    * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)

    * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)

    * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)

    * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)

    Bug Fix(es) and Enhancement(s):

    * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [rhel-10.2.z] (JIRA:Rocky Linux-277809)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8cb08de43 advisory.

    Update to .NET SDK 10.0.113 and Runtime 10.0.13

    Fixes: CVE-2026-102870,CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-     2026-70035,CVE-2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-     2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-     2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-     2026-92707,CVE-2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-     2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96957,CVE-     2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.113.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2150:21 advisory.

    * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
      * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
      * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
      * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
      * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-70159)
      * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
      * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
      * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
      * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability     (CVE-2026-70183)
      * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
      * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
      * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
      * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
      * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length     limits (CVE-2026-92707)
      * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
      * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability     (CVE-2026-96230)
      * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
      * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-96233)
      * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability     (CVE-2026-96236)
      * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
      * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
      * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker     to execute code over a network. (CVE-2026-102870)

  - Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.
    (CVE-2026-111497)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-87697)

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-96224, CVE-2026-96235)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c7c459ff4d advisory.

    Update to .NET SDK 10.0.113 and Runtime 10.0.13

    Fixes: CVE-2026-102870,CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-     2026-70035,CVE-2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-     2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-     2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-     2026-92707,CVE-2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-     2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96957,CVE-     2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.113.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3367 advisory.

    Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker     to execute code over a network. (CVE-2026-102870)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-109468)

    A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing     crafted Brotli input. Successful exploitation may lead to memory corruption and remote code execution.
    (CVE-2026-111497)

    Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
    (CVE-2026-114148)

    Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-58280)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-69651)

    Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70159)

    Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a     network. (CVE-2026-70175)

    Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over     a network. (CVE-2026-70179)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70181)

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET     Core allows an authorized attacker to elevate privileges over a network. (CVE-2026-70183)

    Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-70186)

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70197)

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-83520)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-84008)

    Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized     attacker to perform spoofing over a network. (CVE-2026-96222)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96225)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96231)

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96233)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-96236)

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to     execute code over a network. (CVE-2026-96237)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96958)

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny     service over a network. (CVE-2026-96959)

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service     over a network. (CVE-2026-96960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
370335	Rocky Linux 10.2 [CIQ] Security Update: aspnetcore-runtime-10.0 / aspnetcore-runtime-dbg-10.0 / etc Multiple Vulnerabilities (crlsa-2026_86195)	Nessus	Rocky Linux Local Security Checks	2026/10/22	2026/10/23	critical
370362	Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-10.0 / aspnetcore-runtime-dbg-10.0 / etc Multiple Vulnerabilities (crlsa-2026_86193)	Nessus	Rocky Linux Local Security Checks	2026/10/22	2026/10/23	critical
373715	MiracleLinux 8 : dotnet10.0-10.0.113-1.el8_10 (AXSA:2026-2163:22)	Nessus	Miracle Linux Local Security Checks	2026/10/29	2026/10/29	critical
376148	Oracle Linux 8 : .NET / 10.0 (ELSA-2026-86192)	Nessus	Oracle Linux Local Security Checks	2026/11/4	2026/11/4	critical
374084	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : .NET vulnerabilities (USN-8958-1)	Nessus	Ubuntu Local Security Checks	2026/10/30	2026/11/2	critical
370204	AlmaLinux 8 : .NET 10.0 (ALSA-2026:86192)	Nessus	Alma Linux Local Security Checks	2026/10/21	2026/11/6	critical
369352	RHEL 9 : .NET 10.0 (RHSA-2026:86193)	Nessus	Red Hat Local Security Checks	2026/10/21	2026/10/26	critical
370189	RockyLinux 10 : .NET 10.0 (RLSA-2026:86195)	Nessus	Rocky Linux Local Security Checks	2026/10/21	2026/10/21	critical
371731	Fedora 44 : dotnet10.0 (2026-c8cb08de43)	Nessus	Fedora Local Security Checks	2026/10/24	2026/10/24	critical
373714	MiracleLinux 9 : dotnet10.0-10.0.113-1.el9_8.ML.1 (AXSA:2026-2150:21)	Nessus	Miracle Linux Local Security Checks	2026/10/29	2026/10/29	critical
372462	Security Update for Microsoft ASP.NET Core (October OOB 2026)	Nessus	Windows	2026/10/27	2026/10/29	critical
366546	Security Update for Microsoft .NET Core (October 2026)	Nessus	Windows	2026/10/16	2026/10/19	critical
366547	Security Update for Microsoft .NET Core SDK (October 2026)	Nessus	Windows	2026/10/16	2026/10/19	critical
371740	Fedora 43 : dotnet10.0 (2026-c7c459ff4d)	Nessus	Fedora Local Security Checks	2026/10/24	2026/10/24	critical
374355	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3367)	Nessus	Amazon Linux Local Security Checks	2026/10/30	2026/11/2	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical