Critique
0
Haute
2
Moyenne
5
Faible
0
Inconnue
0
Non affecté
0
Analyse Trivy 0.76.1 des dépendances NuGet (directes et transitives) du code source de la release, avec la base de vulnérabilités au 2026-11-02. Les bibliothèques natives embarquées hors NuGet ne sont pas couvertes.
Vulnérabilités (7)
| Sévérité | Identifiant | CVSS | Paquet | Version | Corrigé en | Description | Analyse |
|---|---|---|---|---|---|---|---|
| Haute | CVE-2026-44302 GHSA-pggp-6c3x-2xmx | 7.5 | Snappier transitive via Parquet.Net | 1.3.0 | 1.3.1 | Snappier has an infinite loop during SnappyStream decompression with malformed framed input | En cours d'analyse |
| Haute | CVE-2026-84008 GHSA-846f-f764-76mx | 7.5 | System.Security.Cryptography.Pkcs transitive via Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core | 8.0.1 | 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21 | dotnet: .NET Denial of Service Vulnerability | En cours d'analyse |
| Moyenne | CVE-2026-42191 GHSA-4625-4j76-fww9 | 7.8 | OpenTelemetry.Exporter.OpenTelemetryProtocol directe | 1.15.2 | 1.15.3 | OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter | En cours d'analyse |
| Moyenne | GHSA-473q-m89c-ghf8 | 6.9 | MySqlConnector directe | 2.5.0 | 2.6.1 | MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified) | Non analysé |
| Moyenne | CVE-2026-70162 GHSA-2fmv-rv2c-59x7 | 5.9 | System.Security.Cryptography.Pkcs transitive via Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core | 8.0.1 | 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21 | dotnet: dotnet: Denial of Service via specially crafted web requests | En cours d'analyse |
| Moyenne | CVE-2026-40894 GHSA-g94r-2vxg-569j | 5.3 | OpenTelemetry.Api transitive via OpenTelemetry | 1.15.2 | 1.15.3 | OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers | En cours d'analyse |
| Moyenne | CVE-2026-40891 GHSA-mr8r-92fq-pj8p | 5.3 | OpenTelemetry.Exporter.OpenTelemetryProtocol directe | 1.15.2 | 1.15.3 | OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling | En cours d'analyse |
Téléchargements
Licences des dépendances
MIT ×79Apache-2.0 ×31BSD-3-Clause ×4PostgreSQL ×1