Microsoft Visual Studio Code vulnerabilities, page 5
99 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio Code, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-70336microsoftvisual studio code
EPSS score0.82%
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-70334microsoftvisual studio codeEPSS score0.49%
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-81383microsoftvisual studio codeEPSS score0.92%
Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.CVE-2026-81357microsoftvisual studio codeEPSS score0.51%
Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-81380microsoftvisual studio codeEPSS score0.62%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.CVE-2026-81377microsoftvisual studio codeEPSS score0.76%
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.CVE-2026-81378microsoftvisual studio codeEPSS score0.54%
Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-81356microsoftvisual studio codeEPSS score0.54%
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-81376microsoftvisual studio codeEPSS score0.90%
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-81379microsoftvisual studio codeEPSS score0.54%
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-81381microsoftvisual studio codeEPSS score0.87%
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.CVE-2026-78461microsoftvisual studio codeEPSS score1.04%
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-78462microsoftvisual studio codeEPSS score0.76%
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-50520microsoftvisual studio codeEPSS score0.35%
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.CVE-2023-21779microsoftvisual studio codeEPSS score2.27%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2023-36742microsoftvisual studio codeEPSS score1.00%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2023-29338microsoftvisual studio codeEPSS score0.88%
Visual Studio Code Spoofing VulnerabilityCVE-2023-24893microsoftvisual studio codeEPSS score1.10%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2023-33144microsoftvisual studio codeEPSS score1.27%
Visual Studio Code Spoofing Vulnerability