Vulnerabilities of Microsoft Visual Studio Code
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-102851 | Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally | 6.1 Medium | Oct 13, 2026 |
| CVE-2026-69370 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an… | 8.8 High | Oct 13, 2026 |
| CVE-2026-102238 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an… | 9.6 Critical | Oct 13, 2026 |
| CVE-2026-70098 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network | 8.8 High | Oct 13, 2026 |
| CVE-2026-102234 | Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a… | 7.4 High | Oct 13, 2026 |
| CVE-2026-102235 | Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a… | 8.8 High | Oct 13, 2026 |
| CVE-2026-102231 | Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security… | 7.7 High | Oct 13, 2026 |
| CVE-2026-102232 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally | 7.0 High | Oct 13, 2026 |
| CVE-2026-102233 | Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally | 7.8 High | Oct 13, 2026 |
| CVE-2026-102229 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an… | 6.8 Medium | Oct 13, 2026 |
| CVE-2026-81383 | Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose… | 7.4 High | Sep 8, 2026 |
| CVE-2026-78462 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a… | 8.8 High | Sep 8, 2026 |
| CVE-2026-81381 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… | 6.5 Medium | Sep 8, 2026 |
| CVE-2026-81379 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature… | 8.2 High | Sep 8, 2026 |
| CVE-2026-81380 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual… | 5.3 Medium | Sep 8, 2026 |
| CVE-2026-81378 | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a… | 8.2 High | Sep 8, 2026 |
| CVE-2026-81377 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an… | 6.5 Medium | Sep 8, 2026 |
| CVE-2026-81376 | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security… | 9.6 Critical | Sep 8, 2026 |
| CVE-2026-81356 | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an… | 8.2 High | Sep 8, 2026 |
| CVE-2026-81357 | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature… | 8.2 High | Sep 8, 2026 |
| CVE-2026-78461 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an… | 7.4 High | Sep 8, 2026 |
| CVE-2026-70334 | Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security… | 7.8 High | Sep 8, 2026 |
| CVE-2026-70335 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and… | 7.8 High | Aug 11, 2026 |
| CVE-2026-70336 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to… | 8.8 High | Aug 11, 2026 |
| CVE-2026-69306 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature… | 8.2 High | Aug 11, 2026 |
Other Microsoft products
Windows Server 2019 5745
Windows Server 2019 (Server Core installation) 5648
Windows 10 Version 1809 5349
Windows Server 2022 5112
Windows Server 2016 5051
Windows Server 2016 (Server Core installation) 4847
Windows 10 Version 21H2 4539
Windows 10 Version 1607 4535
Windows Server 2012 R2 4103
Windows 10 Version 22H2 4041
Windows Server 2012 R2 (Server Core installation) 3958
Windows Server 2012 3865