CyberSecBulletin

NuGet vulnerabilities

We track 2 vulnerabilities in NuGet products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 14, 2026.

2vulnerabilities
2critical
0high
0exploited
9.7average CVSS score

Latest NuGet vulnerabilities

  • 9.6 Critical severity

    NuGet Gallery is a package repository that powers nuget.org.

    CVE-2026-39399NuGet

    NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cro

  • 9.8 Critical severity

    dotnetzip: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2024-48510NuGetEPSS 2.02%

    Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the mainta