CVE Tools
Track your stack

Nuget

797 CVEs across 93 months on the top 200 list since Mar 2010. Peak rank #17 in Feb 2026. 11 of them are now in CISA KEV.

Nuget CVEs per month since Mar 2010

Dec 2021 to Nov 2026 in the lens. Point at a month to read it, or drag the frame to move through the record.Tallest in the lens: 46, Feb 2026
Dec 2021: 4 CVEs · 0 critical · 0 now in CISA KEV · rank #136 · mostly Ajaxnetprofessional, Swashbuckle.aspnetcore.swaggeruiJan 2022: 9 CVEs · 0 critical · 0 now in CISA KEV · rank #65 · mostly Sharpziplib, Umbraco.cms.core, Orchardcore.application.cms.targetsFeb 2022: below the top 200 that month, 2 or fewer CVEsMar 2022: 6 CVEs · 1 critical · 0 now in CISA KEV · rank #105 · mostly C1cms.assemblies, Jquery.cookie, Microsoft.aspnetcore.app.runtime.linux-armApr 2022: 6 CVEs · 0 critical · 1 now in CISA KEV · rank #108 · mostly Cefsharp.common, Cefsharp.common.netcore, Cefsharp.offscreenMay 2022: 11 CVEs · 1 critical · 0 now in CISA KEV · rank #63 · mostly Microsoft.aspnetcore.app.runtime.win-x64, Microsoft.aspnetcore.app.runtime.linux-arm, Microsoft.aspnetcore.app.runtime.linux-arm64Jun 2022: 6 CVEs · 0 critical · 0 now in CISA KEV · rank #111 · mostly Opcfoundation.netstandard.opc.ua.core, Nuget.commands, Nuget.commandlineJul 2022: 3 CVEs · 0 critical · 0 now in CISA KEV · rank #182 · mostly Jquery.ui.combined, Moment.js, Azure.storage.queuesAug 2022: 5 CVEs · 1 critical · 0 now in CISA KEV · rank #123 · mostly Microsoft.aspnetcore.app.runtime.win-x86, Microsoft.aspnetcore.app.runtime.linux-arm, Microsoft.aspnetcore.app.runtime.linux-arm64Sep 2022: 3 CVEs · 1 critical · 0 now in CISA KEV · rank #188 · mostly Compositec1.core, Dotnetnuke.core, Dotnetnuke.webOct 2022: below the top 200 that month, 2 or fewer CVEsNov 2022: 3 CVEs · 0 critical · 0 now in CISA KEV · rank #197 · mostly Akka, Microsoft.data.sqlclient, Net.sf.mpxjDec 2022: 6 CVEs · 0 critical · 0 now in CISA KEV · rank #96 · mostly Microsoft.windowsdesktop.app.runtime.win-x64, Dns, EnumstringvaluesJan 2023: 4 CVEs · 0 critical · 0 now in CISA KEV · rank #142 · mostly Directxtex_desktop_2019, Directxtex_desktop_win10, Directxtex_uwpFeb 2023: below the top 200 that month, 3 or fewer CVEsMar 2023: no snapshot, the run for this month failedApr 2023: 5 CVEs · 0 critical · 0 now in CISA KEV · rank #143 · mostly Serenity.net.core, Serenity.net.web, Microsoft.netcore.app.runtime.win-arm64May 2023: below the top 200 that month, 3 or fewer CVEsJun 2023: 11 CVEs · 1 critical · 0 now in CISA KEV · rank #62 · mostly Microsoft.netcore.app.runtime.win-arm, Microsoft.netcore.app.runtime.win-arm64, Microsoft.netcore.app.runtime.win-x64Jul 2023: below the top 200 that month, 3 or fewer CVEsAug 2023: 5 CVEs · 0 critical · 1 now in CISA KEV · rank #169 · mostly Microsoft.aspnetcore.app.runtime.win-x64, Microsoft.aspnetcore.app.runtime.win-arm64, Microsoft.aspnetcore.app.runtime.win-x86Sep 2023: 9 CVEs · 0 critical · 1 now in CISA KEV · rank #76 · mostly Microsoft.netcore.app.runtime.win-x86, Microsoft.netcore.app.runtime.win-x64, Microsoft.netcore.app.runtime.win-arm64Oct 2023: 10 CVEs · 0 critical · 0 now in CISA KEV · rank #78 · mostly Tinymce, Microsoft.native.quic.msquic.openssl, Microsoft.native.quic.msquic.schannelNov 2023: 4 CVEs · 0 critical · 0 now in CISA KEV · rank #196 · mostly Microsoft.aspnetcore.components, Elastic.apm, System.net.requestsDec 2023: 13 CVEs · 0 critical · 0 now in CISA KEV · rank #58 · mostly Umbraco.cms, Gsemac.net, Opcfoundation.netstandard.opc.ua.coreJan 2024: 15 CVEs · 1 critical · 0 now in CISA KEV · rank #62 · mostly Tinymce, Nuget.commandline, Petero.cborFeb 2024: 8 CVEs · 0 critical · 0 now in CISA KEV · rank #86 · mostly Microsoft.aspnetcore.app.runtime.linux-arm, Microsoft.aspnetcore.app.runtime.linux-musl-arm64, Microsoft.aspnetcore.app.runtime.linux-musl-x64Mar 2024: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #68 · mostly Tinymce, Wix, Microsoft.netcore.app.runtime.linux-arm64Apr 2024: 8 CVEs · 0 critical · 0 now in CISA KEV · rank #111 · mostly Sixlabors.imagesharp, Microsoft.windowsdesktop.app.runtime.win-x64, Microsoft.windowsdesktop.app.runtime.win-x86May 2024: 12 CVEs · 0 critical · 0 now in CISA KEV · rank #106 · mostly Bouncycastle.cryptography, Bouncycastle, Umbracocms.coreJun 2024: 5 CVEs · 0 critical · 0 now in CISA KEV · rank #143 · mostly Tinymce, Azure.identity, Microsoft.azure.storage.datamovementJul 2024: 16 CVEs · 1 critical · 0 now in CISA KEV · rank #49 · mostly Bootstrap, Identityserver4, Sixlabors.imagesharpAug 2024: 6 CVEs · 0 critical · 0 now in CISA KEV · rank #116 · mostly Microsoft.aspnetcore.app.runtime.win-arm, Microsoft.aspnetcore.app.runtime.win-arm64, Microsoft.aspnetcore.app.runtime.win-x64Sep 2024: below the top 200 that month, 3 or fewer CVEsOct 2024: 17 CVEs · 0 critical · 0 now in CISA KEV · rank #42 · mostly Umbraco.cms, Opcfoundation.netstandard.opc.ua, Opcfoundation.netstandard.opc.ua.coreNov 2024: 10 CVEs · 2 critical · 0 now in CISA KEV · rank #99 · mostly System.formats.nrbf, Prodotnetzip, RefitDec 2024: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #92 · mostly Oqtane.server, Oqtane.framework, PiranhaJan 2025: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #70 · mostly Microsoft.netcore.app.runtime.linux-arm64, Microsoft.netcore.app.runtime.linux-musl-arm, Microsoft.netcore.app.runtime.linux-musl-arm64Feb 2025: 9 CVEs · 2 critical · 0 now in CISA KEV · rank #86 · mostly Opcfoundation.netstandard.opc.ua, Opcfoundation.netstandard.opc.ua.bindings.https, AutoqueryableMar 2025: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #136 · mostly Microsoft.aspnetcore.app.runtime.linux-arm64, Microsoft.aspnetcore.app.runtime.linux-musl-arm, Microsoft.aspnetcore.app.runtime.linux-musl-arm64Apr 2025: 8 CVEs · 2 critical · 0 now in CISA KEV · rank #102 · mostly Amazon.iondotnet, Apache.nms.activemq, Cefsharp.offscreenMay 2025: 6 CVEs · 0 critical · 0 now in CISA KEV · rank #132 · mostly Dotnetnuke.core, Umbraco.forms, UmbracoformsJun 2025: 9 CVEs · 0 critical · 0 now in CISA KEV · rank #89 · mostly Dnn.platform, Umbraco.cms, Microsoft.netcore.app.runtime.linux-armJul 2025: 6 CVEs · 0 critical · 0 now in CISA KEV · rank #162 · mostly Magick.net-q16-arm64, Magick.net-q16-hdri-anycpu, Magick.net-q16-hdri-arm64Aug 2025: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #124 · mostly Magick.net-q8-anycpu, Magick.net-q16-anycpu, Magick.net-q16-hdri-x86Sep 2025: 9 CVEs · 1 critical · 0 now in CISA KEV · rank #86 · mostly Dotnetnuke.core, Magick.net-q16-openmp-arm64, Magick.net-q8-arm64Oct 2025: 16 CVEs · 4 critical · 0 now in CISA KEV · rank #71 · mostly Microsoft.build.tasks.core, Dnn.platform, Microsoft.netcore.app.runtime.linux-armNov 2025: below the top 200 that month, 4 or fewer CVEsDec 2025: 13 CVEs · 2 critical · 0 now in CISA KEV · rank #67 · mostly Magick.net-q8-x86, Magick.net-q16-anycpu, Magick.net-q16-hdri-anycpuJan 2026: 13 CVEs · 1 critical · 0 now in CISA KEV · rank #74 · mostly Magick.net-q16-hdri-openmp-x64, Dotnetnuke.core, Magick.net-q16-anycpuFeb 2026: 46 CVEs · 1 critical · 0 now in CISA KEV · rank #17 · mostly Magick.net-q8-openmp-arm64, Magick.net-q8-anycpu, Magick.net-q16-openmp-x64Mar 2026: 43 CVEs · 0 critical · 0 now in CISA KEV · rank #29 · mostly Magick.net-q16-anycpu, Magick.net-q16-hdri-anycpu, Magick.net-q16-hdri-openmp-arm64Apr 2026: 18 CVEs · 1 critical · 0 now in CISA KEV · rank #55 · mostly Magick.net-q8-anycpu, Magick.net-q16-hdri-openmp-arm64, Magick.net-q16-hdri-openmp-x64May 2026: 9 CVEs · 0 critical · 0 now in CISA KEV · rank #150 · mostly Magick.net-q16-openmp-x64, Magick.net-q16-hdri-x64, Magick.net-q16-hdri-x86Jun 2026: below the top 200 that month, 7 or fewer CVEsJul 2026: 24 CVEs · 0 critical · 0 now in CISA KEV · rank #46 · mostly Magick.net-q16-hdri-openmp-arm64, Magick.net-q16-hdri-x64, Magick.net-q16-hdri-x86Aug 2026: below the top 200 that month, 8 or fewer CVEsSep 2026: below the top 200 that month, 9 or fewer CVEsOct 2026: below the top 200 that month, 11 or fewer CVEsNov 2026: none that month (the list had room for every one)

In the lens

The products that kept showing up in Nuget's monthly top three from Dec 2021 to Nov 2026. Move the lens and the list follows.

  1. Magick.net-q8-anycpu543 months
  2. Magick.net-q16-hdri-openmp-arm64453 months
  3. Magick.net-q16-openmp-x64452 months
  4. Magick.net-q8-openmp-arm64421 month
  5. Magick.net-q16-anycpu344 months
  6. Magick.net-q16-hdri-x86293 months
  7. Magick.net-q16-hdri-anycpu283 months
  8. Magick.net-q16-hdri-x64232 months
  9. Umbraco.cms143 months
  10. Dotnetnuke.core124 months

Year by year

Each year's months on the top 200 list. Pick a year to read it in the lens.

The record

Peak rank
#17 in Feb 2026
Busiest month
Feb 2026, 46 CVEs
Months with a KEV entry
8 of 93 on the list
On the top 200 list
93 of 183 monthly snapshots

Each monthly snapshot keeps the top 200 vendors by CVEs. A month below the cut shows the most it could have had: the smallest count that made the list. 18 months have no snapshot because the run failed.

MethodologyAll months on recordThe Nuget hub