Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54784 · Other software · CoreWCF · reported by GitHubHigh 7.4
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54783 · Other software · CoreWCF · reported by GitHubHigh 7.4
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with one captured signed SOAP envelope to replay arbitrary service operations as the victim principal. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54782 · Other software · CoreWCF · reported by GitHubCritical 10
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54781 · Other software · CoreWCF · reported by GitHubHigh 7.4
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54780 · Other software · CoreWCF · reported by GitHubLow 3.7
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference DigestMethod, allowing a sender to use a rejected digest algorithm such as SHA-1 while the message is still accepted. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54779 · Other software · CoreWCF · reported by GitHubMedium 5.9
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captured token to be reused. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54778 · Other software · CoreWCF · reported by GitHubMedium 6.2
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF UnixDomainSocket POSIX peer identity resolution uses non-reentrant getpwuid and getgrgid calls, allowing concurrent connections to attribute one connection's identity to another or crash the host process under contention. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54776 · Other software · CoreWCF · reported by GitHubMedium 4.4
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service hosted on Unix Domain Sockets with PosixIdentity client credentials can accept connections that skip the application/unixposix stream upgrade before dispatching messages, bypassing framing-layer identity checks in UnixPosixIdentitySecurityUpgradeProvider. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54775 · Other software · CoreWCF · reported by GitHubMedium 6.5
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, a CoreWCF service listening on a Kafka topic stops processing new records from that topic when KafkaTransportPump receives a null-value tombstone record, causing a persistent endpoint denial of service for attackers with produce permission. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54774 · Other software · CoreWCF · reported by GitHubHigh 7.4
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token, allowing an attacker to reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54773 · Other software · CoreWCF · reported by GitHubMedium 5.9
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security and cause WSSecurityOneDotZeroReceiveSecurityHeader to verify an attacker-supplied signature instead of the security header signature. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54772 · Other software · CoreWCF · reported by GitHubHigh 7.5
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per connection. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2026CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2026-54777 · Other software · CoreWCF · reported by GitHubMedium 6.5
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic when an attacker races NamedPipeListener startup between shared memory GUID publication and service named pipe creation. This issue is fixed in versions 1.8.1 and 1.9.1.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2024CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.CVE-2024-28252 · Other software · CoreWCF · reported by GitHubHigh 7.5
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can happen. When a client established a connection to the service and sends no data, the service will wait indefinitely for the client to initiate the NetFraming session handshake. Additionally, once a client has established a session, if the client doesn't send any requests for the period of time configured in the binding ReceiveTimeout, the connection is not properly closed as part of the session being aborted. The bindings affected by this behavior are NetTcpBinding, NetNamedPipeBinding, and UnixDomainSocketBinding. Only NetTcpBinding has the ability to accept non local connections. The currently supported versions of CoreWCF are v1.4.x and v1.5.x. The fix can be found in v1.4.2 and v1.5.2 of the CoreWCF packages. Users are advised to upgrade. There are no workarounds for this issue.
- Product
- CoreWCF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.