CVE-2026-102870

HighCVSS 8.8/10Last modified Oct 22, 2026

Description

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 22, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1028747.3A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of tCVE-2026-1028757.8VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vltCVE-2026-1028768.1SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against SurrealCVE-2026-1028774.4Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooCVE-2026-1028788.1mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restCVE-2026-1028795.0ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. AuthenticCVE-2026-102887.3A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify ofCVE-2026-102894.3A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown function of the file /CVE-2026-1028939.1Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity proCVE-2026-1028997.6Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attaCVE-2026-10295.4IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. TCVE-2026-102907.3A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the