Some of the versions that NuGet currently references have known vulnerabilities, causing NuGetAudit warnings when restoring NuGet.sln.

Note that NuGet doesn't ship any of MSBuild's assemblies. So, even if NuGet compiles against a vulnerable version, it's not a problem, because Visual Studio and the .NET SDK will ship different versions.