EUVD-2026-73074

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-70334

Visual Studio Code contains a security feature bypass caused by an incomplete list of disallowed inputs , allowing a local, unprivileged attacker (with user interaction) to circumvent a security control. The CVSS 3.1 score is 7.8 (HIGH) , reflecting high impact to confidentiality, integrity, and ...

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Tampering Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Information Disclosure Vulnerability

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-81379: Not Failing Securely

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-88060

VULN-196220 is now CVE-2026-81376. It is a very simple and very dangerous vulnerability that allows code execution when opening untrusted code in sandboxed untrusted mode. Please update ASAP!...

CVE-2026-78461: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-88065

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-88061

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...

PT-2026-88002

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...