[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-45491":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":195,"aliases":196,"duplicate_of":9,"upstream":200,"downstream":201,"duplicates":240,"related":241,"reserved_at":9,"published_at":244,"modified_at":245,"state":246,"summary":247,"references_raw":256,"kevs":284,"epss":285,"epss_history":288,"metrics":368,"affected":381},"CVE-2026-45491","Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","weakness","Draft","Base","Medium",[20,101,162,191],{"id":21,"name":22,"techniques":23},"CAPEC-132","Symlink Attack",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1547.009","Shortcut Modification",[28,31],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,44,48,52,57,62,67,72,77,81,85,89,93,97],{"id":36,"name":37,"tactic":38},"D3-FA","File Analysis",{"name":39},"Detect",{"id":41,"name":42,"tactic":43},"D3-FIM","File Integrity Monitoring",{"name":39},{"id":45,"name":46,"tactic":47},"D3-DA","Dynamic Analysis",{"name":39},{"id":49,"name":50,"tactic":51},"D3-EFA","Emulated File Analysis",{"name":39},{"id":53,"name":54,"tactic":55},"D3-FEV","File Eviction",{"name":56},"Evict",{"id":58,"name":59,"tactic":60},"D3-DF","Decoy File",{"name":61},"Deceive",{"id":63,"name":64,"tactic":65},"D3-FE","File Encryption",{"name":66},"Harden",{"id":68,"name":69,"tactic":70},"D3-RF","Restore File",{"name":71},"Restore",{"id":73,"name":74,"tactic":75},"D3-CF","Content Filtering",{"name":76},"Isolate",{"id":78,"name":79,"tactic":80},"D3-LFP","Local File Permissions",{"name":76},{"id":82,"name":83,"tactic":84},"D3-RFAM","Remote File Access Mediation",{"name":76},{"id":86,"name":87,"tactic":88},"D3-CQ","Content Quarantine",{"name":76},{"id":90,"name":91,"tactic":92},"D3-CM","Content Modification",{"name":76},{"id":94,"name":95,"tactic":96},"D3-EAL","Executable Allowlisting",{"name":76},{"id":98,"name":99,"tactic":100},"D3-EDL","Executable Denylisting",{"name":76},{"id":102,"name":103,"techniques":104},"CAPEC-17","Using Malicious Files",[105,142],{"id":106,"name":107,"tactics":108,"countermeasures":120},"T1574.005","Executable Installer File Permissions Weakness",[109,110,111,114,117],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},"TA0030","Defense Evasion",{"id":115,"name":116},"TA0005","Stealth",{"id":118,"name":119},"TA0104","Execution",[121,126,130,134,138],{"id":122,"name":123,"tactic":124},"D3-SWI","Software Inventory",{"name":125},"Model",{"id":127,"name":128,"tactic":129},"D3-AVE","Asset Vulnerability Enumeration",{"name":125},{"id":131,"name":132,"tactic":133},"D3-SBV","Service Binary Verification",{"name":39},{"id":135,"name":136,"tactic":137},"D3-SU","Software Update",{"name":66},{"id":139,"name":140,"tactic":141},"D3-RS","Restore Software",{"name":71},{"id":143,"name":144,"tactics":145,"countermeasures":151},"T1574.010","Services File Permissions Weakness",[146,147,148,149,150],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},{"id":115,"name":116},{"id":118,"name":119},[152,154,156,158,160],{"id":122,"name":123,"tactic":153},{"name":125},{"id":127,"name":128,"tactic":155},{"name":125},{"id":131,"name":132,"tactic":157},{"name":39},{"id":135,"name":136,"tactic":159},{"name":66},{"id":139,"name":140,"tactic":161},{"name":71},{"id":163,"name":164,"techniques":165},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[166,173,180],{"id":167,"name":168,"tactics":169,"countermeasures":172},"T1027.006","HTML Smuggling",[170,171],{"id":112,"name":113},{"id":115,"name":116},[],{"id":174,"name":175,"tactics":176,"countermeasures":179},"T1027.009","Embedded Payloads",[177,178],{"id":112,"name":113},{"id":115,"name":116},[],{"id":181,"name":182,"tactics":183,"countermeasures":186},"T1564.009","Resource Forking",[184,185],{"id":112,"name":113},{"id":115,"name":116},[187],{"id":188,"name":189,"tactic":190},"D3-FFV","File Format Verification",{"name":76},{"id":192,"name":193,"techniques":194},"CAPEC-76","Manipulating Web Input to File System Calls",[],[],[197,198,199],"GHSA-7q4v-2mr6-5gpx","BIT-dotnet-2026-45491","BIT-dotnet-sdk-2026-45491",[],[202,204,206,208,210,212,214,216,218,220,222,224,226,228,230,232,234,236,238],{"_key":203},"USN-8420-1",{"_key":205},"UBUNTU-CVE-2026-45491",{"_key":207},"RHSA-2026:25110",{"_key":209},"RHSA-2026:25111",{"_key":211},"RHSA-2026:25112",{"_key":213},"RHSA-2026:25113",{"_key":215},"RHSA-2026:25114",{"_key":217},"RHSA-2026:25115",{"_key":219},"RHSA-2026:25220",{"_key":221},"RHSA-2026:25221",{"_key":223},"RHSA-2026:25222",{"_key":225},"RHSA-2026:28007",{"_key":227},"RHSA-2026:28009",{"_key":229},"RHSA-2026:28011",{"_key":231},"RHSA-2026:28051",{"_key":233},"RHSA-2026:28227",{"_key":235},"RHSA-2026:17527",{"_key":237},"RHSA-2026:26638",{"_key":239},"RHSA-2026:26994",[],[242],{"_key":243},"CGA-M6H5-2463-WGQX","2026-06-09T17:04:44.457Z","2026-07-15T20:09:10.277Z","Awaiting Analysis",{"cisa_kev":248,"cisa_ransomware":248,"cisa_vendor":9,"epss_severity":249,"epss_score":250,"severity":251,"severity_score":252,"severity_version":253,"severity_source":254,"severity_vector":255,"severity_status":246},false,"low",0.00388,"medium",6.2,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",[257,266,270,275,279],{"url":258,"sources":259,"tags":262},"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45491",[254,260,261],"nvd","osv_nuget",[263,264,265],"Vendor Advisory","Patch","WEB",{"url":267,"sources":268,"tags":269},"https://github.com/dotnet/runtime/security/advisories/GHSA-7q4v-2mr6-5gpx",[261],[265],{"url":271,"sources":272,"tags":273},"https://nvd.nist.gov/vuln/detail/CVE-2026-45491",[261],[274],"Advisory",{"url":276,"sources":277,"tags":278},"https://github.com/dotnet/announcements/issues/404",[261],[265],{"url":280,"sources":281,"tags":282},"https://github.com/dotnet/runtime",[261],[283],"PACKAGE",[],{"date":286,"score":250,"percentile":287},"2026-07-05",0.3083,[289,293,296,299,302,305,309,312,315,319,322,325,328,331,334,337,340,343,346,349,352,355,358,361,364,367],{"date":290,"score":291,"percentile":292},"2026-06-10",0.00092,0.25804,{"date":294,"score":291,"percentile":295},"2026-06-11",0.25814,{"date":297,"score":291,"percentile":298},"2026-06-12",0.26014,{"date":300,"score":291,"percentile":301},"2026-06-13",0.2603,{"date":303,"score":291,"percentile":304},"2026-06-14",0.26016,{"date":306,"score":307,"percentile":308},"2026-06-15",0.00301,0.21518,{"date":310,"score":307,"percentile":311},"2026-06-16",0.21547,{"date":313,"score":307,"percentile":314},"2026-06-17",0.21555,{"date":316,"score":317,"percentile":318},"2026-06-18",0.00272,0.1878,{"date":320,"score":317,"percentile":321},"2026-06-19",0.18767,{"date":323,"score":317,"percentile":324},"2026-06-20",0.18758,{"date":326,"score":317,"percentile":327},"2026-06-21",0.18742,{"date":329,"score":317,"percentile":330},"2026-06-22",0.18725,{"date":332,"score":250,"percentile":333},"2026-06-23",0.30527,{"date":335,"score":250,"percentile":336},"2026-06-24",0.30562,{"date":338,"score":250,"percentile":339},"2026-06-25",0.30644,{"date":341,"score":250,"percentile":342},"2026-06-26",0.30685,{"date":344,"score":250,"percentile":345},"2026-06-27",0.30717,{"date":347,"score":250,"percentile":348},"2026-06-28",0.3069,{"date":350,"score":250,"percentile":351},"2026-06-29",0.30689,{"date":353,"score":250,"percentile":354},"2026-06-30",0.30665,{"date":356,"score":250,"percentile":357},"2026-07-01",0.30769,{"date":359,"score":250,"percentile":360},"2026-07-02",0.30798,{"date":362,"score":250,"percentile":363},"2026-07-03",0.30817,{"date":365,"score":250,"percentile":366},"2026-07-04",0.30819,{"date":286,"score":250,"percentile":287},[369,374,377],{"source":254,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":370,"cvss_v4_0":9},{"baseScore":252,"baseSeverity":371,"vectorString":255,"impactScore":372,"exploitabilityScore":373},"MEDIUM",6,6.4,{"source":260,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":375,"cvss_v4_0":9},{"baseScore":252,"baseSeverity":371,"vectorString":376,"impactScore":372,"exploitabilityScore":373},"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",{"source":261,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":378,"cvss_v4_0":9},{"baseScore":379,"baseSeverity":9,"vectorString":380,"impactScore":4,"exploitabilityScore":373},6.8,"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",[382,395,406,414,426,432],{"ecosystem":9,"name":383,"vendor":384,"product":385,"cpe_part":386,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":387},".NET 10.0","microsoft",".net 10.0","a",[388],{"version":389,"is_range":390,"range_type":254,"version_start":391,"version_start_type":392,"version_end":393,"version_end_type":394,"fixed_in":9},">= 10.0.0, \u003C 10.0.9",true,"10.0.0","including","10.0.9","excluding",{"ecosystem":9,"name":396,"vendor":384,"product":397,"cpe_part":386,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":398},".NET 8.0",".net 8.0",[399,403],{"version":400,"is_range":390,"range_type":254,"version_start":401,"version_start_type":392,"version_end":402,"version_end_type":394,"fixed_in":9},">= 8.0, \u003C 8.0.28","8.0","8.0.28",{"version":404,"is_range":390,"range_type":254,"version_start":405,"version_start_type":392,"version_end":402,"version_end_type":394,"fixed_in":9},">= 8.0.0, \u003C 8.0.28","8.0.0",{"ecosystem":9,"name":407,"vendor":384,"product":408,"cpe_part":386,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":409},".NET 9.0",".net 9.0",[410],{"version":411,"is_range":390,"range_type":254,"version_start":412,"version_start_type":392,"version_end":413,"version_end_type":394,"fixed_in":9},">= 9.0.0, \u003C 9.0.17","9.0.0","9.0.17",{"ecosystem":415,"name":416,"vendor":415,"product":416,"cpe_part":9,"purl_type":417,"purl_namespace":9,"purl_name":416,"source":9,"versions":418},"NuGet","Microsoft.NetCore.App.Runtime.linux-x64","nuget",[419,422,424],{"version":420,"is_range":390,"range_type":421,"version_start":405,"version_start_type":392,"version_end":402,"version_end_type":394,"fixed_in":9},"gte8_0_0_lt8_0_28","ecosystem",{"version":423,"is_range":390,"range_type":421,"version_start":412,"version_start_type":392,"version_end":413,"version_end_type":394,"fixed_in":9},"gte9_0_0_lt9_0_17",{"version":425,"is_range":390,"range_type":421,"version_start":391,"version_start_type":392,"version_end":393,"version_end_type":394,"fixed_in":9},"gte10_0_0_lt10_0_9",{"ecosystem":415,"name":427,"vendor":415,"product":427,"cpe_part":9,"purl_type":417,"purl_namespace":9,"purl_name":427,"source":9,"versions":428},"Microsoft.NetCore.App.Runtime.osx-arm64",[429,430,431],{"version":420,"is_range":390,"range_type":421,"version_start":405,"version_start_type":392,"version_end":402,"version_end_type":394,"fixed_in":9},{"version":423,"is_range":390,"range_type":421,"version_start":412,"version_start_type":392,"version_end":413,"version_end_type":394,"fixed_in":9},{"version":425,"is_range":390,"range_type":421,"version_start":391,"version_start_type":392,"version_end":393,"version_end_type":394,"fixed_in":9},{"ecosystem":415,"name":433,"vendor":415,"product":433,"cpe_part":9,"purl_type":417,"purl_namespace":9,"purl_name":433,"source":9,"versions":434},"Microsoft.NetCore.App.Runtime.win-x64",[435,436,437],{"version":420,"is_range":390,"range_type":421,"version_start":405,"version_start_type":392,"version_end":402,"version_end_type":394,"fixed_in":9},{"version":423,"is_range":390,"range_type":421,"version_start":412,"version_start_type":392,"version_end":413,"version_end_type":394,"fixed_in":9},{"version":425,"is_range":390,"range_type":421,"version_start":391,"version_start_type":392,"version_end":393,"version_end_type":394,"fixed_in":9}]