CVE-20XX-?

Microsoft Visual Studio Code CVEs.

Published CVEs affecting Microsoft Visual Studio Code, ranked by exploit odds.

18 CVEs · updated 2026-11-06 09:54 UTC

Reset all
  1. CVE-2026-81383

    Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Other Microsoft Visual Studio Code

    7.4 HIGH 0.9% exploit odds Fix listed
  2. CVE-2026-81376

    Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    9.6 CRITICAL 0.9% exploit odds Fix listed
  3. CVE-2026-81381

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Other Microsoft Visual Studio Code

    6.5 MEDIUM 0.9% exploit odds Fix listed
  4. CVE-2026-41109

    Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.8 HIGH 0.9% exploit odds Fix listed
  5. CVE-2025-21264

    Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.1 HIGH 0.8% exploit odds Fix listed
  6. CVE-2026-21523

    Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

    Other Microsoft Visual Studio Code

    8.0 HIGH 0.8% exploit odds Fix listed
  7. CVE-2025-24039

    Visual Studio Code Elevation of Privilege Vulnerability

    Other Microsoft Visual Studio Code

    7.3 HIGH 0.7% exploit odds Fix listed
  8. CVE-2026-40376

    Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

    Other Microsoft Visual Studio Code

    7.5 HIGH 0.7% exploit odds Fix listed
  9. CVE-2025-26631

    Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.

    Other Microsoft Visual Studio Code

    7.3 HIGH 0.6% exploit odds Fix listed
  10. CVE-2026-69306

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  11. CVE-2026-81356

    Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  12. CVE-2026-81378

    Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  13. CVE-2026-81379

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  14. CVE-2026-70334

    Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.8 HIGH 0.5% exploit odds Fix listed
  15. CVE-2025-62453

    Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    5.0 MEDIUM 0.4% exploit odds Fix listed
  16. CVE-2026-102231

    Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.7 HIGH 0.4% exploit odds Fix listed
  17. CVE-2026-48569

    Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.1 HIGH 0.4% exploit odds Fix listed
  18. CVE-2026-69278

    Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.8 HIGH 0.3% exploit odds Fix listed

All CVEs affecting Microsoft Visual Studio Code that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.