Asp.Net Core
Vendor:
First CVE: Nov 15, 2017 · Active for 8 years
39
Total CVEs
More Total CVEs than 97% of tracked products
4.3
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 59% of tracked products
5.1%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Asp.Net Core over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 15, 2017
8 years ago
Most Recent CVE
Jun 9, 2026
45 days ago
CVE Severity & Scoring
Asp.Net Core39 CVEs
15%
79%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local4 (10.3%)
Network35 (89.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low38 (97.4%)
High1 (2.6%)
Unknown0 (0.0%)
User Interaction
None32 (82.1%)
Unknown0 (0.0%)
Required7 (17.9%)
Privileges Required
Low6 (15.4%)
High0 (0.0%)
None33 (84.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (39 CVEs).
39 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through | Oct 10, 2023 | 7.5 | 97 | YES | YES |
CVE-2025-55315CRITICAL Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. | Oct 14, 2025 | 9.9 | 82 | NO | YES |
CVE-2023-38180HIGH .NET and Visual Studio Denial of Service Vulnerability | Aug 8, 2023 | 7.5 | 70 | YES | NO |
CVE-2026-40372CRITICAL Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. | Apr 21, 2026 | 9.1 | 48 | NO | NO |
CVE-2026-45591HIGH Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Jun 9, 2026 | 7.5 | 33 | NO | NO |
CVE-2018-0787HIGH ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core El | Mar 14, 2018 | 8.8 | 33 | NO | NO |
CVE-2026-26130HIGH Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Mar 10, 2026 | 7.5 | 32 | NO | NO |
CVE-2020-0603HIGH A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability c | Jan 14, 2020 | 8.8 | 30 | NO | NO |
CVE-2019-1302HIGH An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NE | Sep 11, 2019 | 8.8 | 30 | NO | NO |
CVE-2018-8292HIGH An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerabil | Oct 10, 2018 | 7.5 | 30 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (39 CVEs).
CISA KEV
2 CVEs
5.1% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
5.1% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (39 CVEs).
Media Mentions
Signals from CVEs in this product scope (39 CVEs).
Top CNAs Publishing CVEs For Asp.Net Core
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 8.0.0 | 2 | 6.5 | 1.9% | 0 | 0 |
| 6.0 | 1 | 8.8 | 0.7% | 0 | 0 |
| 5.0 | 1 | 8.8 | 0.7% | 0 | 0 |
| 3.1 | 5 | 8.0 | 8.1% | 0 | 0 |
| 3.0 | 3 | 8.4 | 10.8% | 0 | 0 |
| 2.2 | 5 | 7.5 | 5.9% | 0 | 0 |
| 2.1 | 10 | 7.5 | 8.7% | 0 | 0 |
| 2.0 | 9 | 7.6 | 7.4% | 0 | 0 |
| 1.1 | 7 | 7.4 | 9.0% | 0 | 0 |
| 1.0 | 7 | 7.4 | 9.0% | 0 | 0 |