EUVD-2026-73332

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81356

Visual Studio Code is affected by an HTTP request/response smuggling vulnerability caused by inconsistent interpretation of HTTP requests. An unauthorized attacker can exploit this over a network to bypass a security feature , requiring user interaction. The Microsoft CVSS 3.1 score is 8.2 (HIGH)...

EUVD-2026-73330

Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-73331

Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81357

CVE-2026-81357 is a server-side request forgery (SSRF) vulnerability in Visual Studio Code that allows an unauthorized attacker to bypass a security feature over a network . The vulnerability requires user interaction but no prior privileges, and has a CVSS 3.1 score of 8.2 (HIGH) with high confi...

CVE-2026-78461

Visual Studio Code is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to bypass a security feature over a network. The flaw requires user interaction but no prior authentication. Per the CNA (Microsoft),...

EUVD-2026-73297

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-77907

A heap-based buffer overflow in Visual Studio allows an unauthorized attacker to achieve remote code execution over a network. The CVSS v3.1 score is 8.8 (High) , with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning user interaction is required but no prior privileges are needed. CISA's ...

EUVD-2026-73293

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

EUVD-2026-73074

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-70334

Visual Studio Code contains a security feature bypass caused by an incomplete list of disallowed inputs , allowing a local, unprivileged attacker (with user interaction) to circumvent a security control. The CVSS 3.1 score is 7.8 (HIGH) , reflecting high impact to confidentiality, integrity, and ...

CVE-2026-69522

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

CVE-2026-69522

This is a heap-based buffer overflow in Visual Studio (and .NET , per the CVE record) that enables an unauthorized, remote attacker to achieve code execution over a network. The CVSS 3.1 base score is 8.8 (High) with an attack vector of network , low complexity, no privileges required, but user i...

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

.NET and Visual Studio Remote Code Execution Vulnerability

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

Copilot Studio Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network...

Microsoft Discovery Studio Information Disclosure Vulnerability

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network...

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...