CVE-2026-81377: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...

CVE-2026-70334: Incomplete List of Disallowed Inputs

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-69439: Heap-based Buffer Overflow

Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network...

PT-2026-88003

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-88065

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-81380: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-88002

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81381: Insufficiently Protected Credentials

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-87538

@deskmodder Important context: CVE-2026-69522 is a UI:R crafted-file RCE in this servicing set. If Visual Studio is in the environment, pair the .NET bumps with VS 2026 18.9.3 or VS 2022 17.14.40...

CVE-2026-77907: Heap-based Buffer Overflow

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

PT-2026-87822

Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...

PT-2026-87981

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

CVE-2026-71328

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

CVE-2026-78461: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

KLA91277 PE vulnerability in Microsoft Developer Tools

Privilege escalation vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-69805 Exploitation Related products Microsoft-Visual-Studio CVE list CVE-2026-69805 critical KB list Solution Install necessar...

KLA91265 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

PT-2026-87980

🚨 CVE-2026-77906 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. 🎖@cveNotify...

RUSTSEC-2026-0281 `greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...

RUSTSEC-2026-0280 `greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...