Critical
0
High
2
Medium
2
Low
0
Unknown
0
Not affected
0
Trivy 0.76.1 scan of the NuGet dependencies (direct and transitive) of the release source code, with the vulnerability database as of 2026-11-02. Native libraries shipped outside NuGet are not covered.
Vulnerabilities (4)
| Severity | Identifier | CVSS | Package | Version | Fixed in | Description | Assessment |
|---|---|---|---|---|---|---|---|
| High | CVE-2026-44302 GHSA-pggp-6c3x-2xmx | 7.5 | Snappier transitive via Parquet.Net | 1.2.0 | 1.3.1 | Snappier has an infinite loop during SnappyStream decompression with malformed framed input | Under investigation |
| High | CVE-2026-84008 GHSA-846f-f764-76mx | 7.5 | System.Security.Cryptography.Pkcs transitive via Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core | 8.0.1 | 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21 | dotnet: .NET Denial of Service Vulnerability | Under investigation |
| Medium | GHSA-473q-m89c-ghf8 | 6.9 | MySqlConnector direct | 2.5.0 | 2.6.1 | MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified) | Not assessed |
| Medium | CVE-2026-70162 GHSA-2fmv-rv2c-59x7 | 5.9 | System.Security.Cryptography.Pkcs transitive via Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core | 8.0.1 | 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21 | dotnet: dotnet: Denial of Service via specially crafted web requests | Under investigation |
Dependency licenses
MIT ×72Apache-2.0 ×24BSD-3-Clause ×3PostgreSQL ×1