12449 matches found
CVE-2026-54701
The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to Stored XSS in versions prior to 0.8.30 . The extension improperly handles repository-controlled content from .crossnote/head.html by passing it through resolvePathsInHeader and inserting it into the webview head witho...
CVE-2026-54703
The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to an arbitrary file write in versions prior to 0.8.30 . The root cause is that the _crossnote.updateMarkdown command accepts an arbitrary URI and attacker-controlled content, passing them to vscode.workspace.fs.writeFil...
CVE-2026-54703 Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...
EUVD-2026-101582
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54566 Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54566 Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext, which does not provide a security boundary from the Node.js hos...
CVE-2026-54525
The Markdown Preview Enhanced extension for Visual Studio Code is vulnerable to OS Command Injection prior to version 0.8.28 . The root cause is the improper neutralization of special elements in the preview-link handling logic, where a decoded, Markdown-controlled link target is passed to a Wind...
CVE-2026-54525 Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that invokes childprocess.exec with the start command. When a Windo...
avdroot
avdroot Root an Android Studio emulator by patching its ramdisk with Magisk — in pure Go. English · 简体中文 avdroot takes an AVD from a cold start to a working root shell with one command. Everything happens on the host: the ramdisk is decompressed, rewritten so Magisk's init replaces /init, and re...
CVE-2026-70098
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-102234
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-102235
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-102238
Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed...
GHSA-MC4Q-93X5-F6HJ Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Signed...
CVE-2026-69370
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-103572
Improper control of generation of code 'code injection' in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network...
CVE-2026-102869
Access of resource using incompatible type 'type confusion' in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network...