PT-2026-70370

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclose information over a network. Recommendations A...

PT-2026-70399

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description An authorization bypass exists that allows an unauthorized attacker to bypass a security feature locally through a user-controlled key. Recommendations At the moment, there is no...

PT-2026-70742

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description An OS command injection issue exists where improper neutralization of special elements used in an OS command allows an unauthorized attacker to execute code over a network...

PT-2026-70768

Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in an OS command, known as OS command injection, allows an unauthorized attacker to...

PT-2026-70769

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Improper control of code generation leads to a code injection flaw, which allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment,...

PT-2026-70740

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Incorrect authorization allows an unauthorized attacker to bypass a security feature locally. Recommendations At the moment, there is no information about a newer version that...

PT-2026-70135

Name of the Vulnerable Software and Affected Versions HumanSignal Label Studio versions prior to 1.24.0.dev0 Description An authenticated user can perform a server-side request forgery SSRF because the SSRF PROTECTION ENABLED variable is set to false by default. This allows the 'import-from-URL'...

CVE-2026-72560: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-69278: Incorrect Authorization

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-69306: Not Failing Securely

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-70335: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally...

CVE-2026-70336: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-58650: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-47285: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-65675: Missing Authorization

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-69320: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an os command 'os command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

PT-2026-70741

Name of the Vulnerable Software and Affected Versions Visual Studio Code affected versions not specified Description Visual Studio Code fails to fail securely, a condition known as failing open, which allows an unauthorized attacker to bypass a security feature over a network. Recommendations At...

PT-2026-70661

Name of the Vulnerable Software and Affected Versions Visual Studio Code CoPilot Chat Extension affected versions not specified Description An unauthorized attacker can bypass a security feature over a network within the Visual Studio Code CoPilot Chat Extension. Recommendations At the moment,...

KLA91206 Multiple vulnerabilities in Microsoft Visual Studio Code

Multiple vulnerabilities were found in Microsoft Visual Studio Code. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, gain privileges. Below is a complete list of vulnerabilities: 1. A remote code execution...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...