On net10.0, NuGet Audit looks one level deeper.

It checks the packages your packages pulled in.

App.csprojyour project

Newtonsoft.Json.Bson 1.0.2you added this

Newtonsoft.Json 12.0.1it pulled this in

net9.0 checks
this level

net10.0 checks
this level too

warning NU1903: Package 'Newtonsoft.Json' 12.0.1 has a known high severity vulnerability

.NET SDK 10.0.201 · fix: dotnet nuget why, then bump the parent or pin 13.0.1

gdhami.net