Vulnerabilities of Microsoft Visual Studio Code
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-69278 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally | 7.8 High | Aug 11, 2026 |
| CVE-2026-69320 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code… | 8.8 High | Aug 11, 2026 |
| CVE-2026-47285 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an… | 6.5 Medium | Aug 11, 2026 |
| CVE-2026-59113 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network | 8.8 High | Aug 11, 2026 |
| CVE-2026-58650 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a… | 7.8 High | Aug 11, 2026 |
| CVE-2026-57102 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass… | 8.8 High | Jul 14, 2026 |
| CVE-2026-57101 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an… | 7.1 High | Jul 14, 2026 |
| CVE-2026-50520 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an… | 8.4 High | Jul 14, 2026 |
| CVE-2026-45496 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an… | 5.5 Medium | Jul 14, 2026 |
| CVE-2026-47282 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… | 6.5 Medium | Jul 14, 2026 |
| CVE-2026-48569 | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally | 7.1 High | Jun 9, 2026 |
| CVE-2026-47284 | Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to… | 6.5 Medium | Jun 9, 2026 |
| CVE-2026-47281 | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network | 9.6 Critical | Jun 9, 2026 |
| CVE-2026-40376 | Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network | 7.5 High | Jun 9, 2026 |
| CVE-2026-47287 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network | 6.5 Medium | Jun 9, 2026 |
| CVE-2026-41613 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network | 8.8 High | May 12, 2026 |
| CVE-2026-41611 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an… | 7.8 High | May 12, 2026 |
| CVE-2026-41109 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and… | 8.8 High | May 12, 2026 |
| CVE-2026-41610 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an… | 6.3 Medium | May 12, 2026 |
| CVE-2026-21523 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to… | 8.0 High | Feb 10, 2026 |
| CVE-2026-21518 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual… | 8.8 High | Feb 10, 2026 |
| CVE-2025-64660 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a… | 8.0 High | Nov 20, 2025 |
| CVE-2025-62453 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to… | 5.0 Medium | Nov 11, 2025 |
| CVE-2025-55319 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network | 8.8 High | Sep 12, 2025 |
| CVE-2025-21264 | Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a… | 7.1 High | May 13, 2025 |
Other Microsoft products
Windows Server 2019 5745
Windows Server 2019 (Server Core installation) 5648
Windows 10 Version 1809 5349
Windows Server 2022 5112
Windows Server 2016 5051
Windows Server 2016 (Server Core installation) 4847
Windows 10 Version 21H2 4539
Windows 10 Version 1607 4535
Windows Server 2012 R2 4103
Windows 10 Version 22H2 4041
Windows Server 2012 R2 (Server Core installation) 3958
Windows Server 2012 3865