GHSA-fcpv-w245-r2q7
NoneDotNetNuke.Core security code analysis rules triggered
CVSS
—
EPSS
—
Published
Apr 14, 2026
CISA due date
—
The record
The codebase raises code analysis warnings related to security, including CA3075, CA5366, CA5371, CA5368, CA5369, CA5372, CA5379, CA5350, and CA5351. Most of these deal with disabling DTD processing in XML documents, but also includes cryptographic algorithm choices.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-38739 ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CWE-937
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CWE-937
- CVE-2026-47255 AgenticMail API/storage and outbound relay hardening fixes CWE-937
- CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections… CWE-937
- CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64 CWE-937
- GHSA-7cwm-fpfh-rrch Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces CWE-937
- GHSA-hfc8-w5f4-3x6m Ironic Standalone Operator's controller modifies user-owned resources without consent CWE-937
- GHSA-92vj-hp7m-gwcj Nerdbank.MessagePack has Inefficient CPU Computation CWE-937