CVE-2026-120796

MediumCVSS 5.3/10Last modified Nov 11, 2026

Description

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-407

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-12084.3The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.CVE-2026-120807.3A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys cCVE-2026-1208037.1A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWiCVE-2026-1208047.5A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When processing certain autheCVE-2026-1208054.3In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-CVE-2026-1208065.5A flaw in MongoDB Server's user management commands may lead to incomplete cleanup of role authorization data when roles are dropped from a CVE-2026-1208076.6A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a holder of a cluster-member certificate to gain elevated inteCVE-2026-1208087.4An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connectionCVE-2026-1208096.8A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on timeCVE-2026-120815.0The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserCVE-2026-1208106.5An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sendingCVE-2026-1208115.9A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference
CVE-2026-120796: Medium severity, CVSS 5.3 | Vulnix