CVE-2026-47282

Summary: CVE-2026-47282 concerns insufficiently protected credentials in GitHub Copilot and Visual Studio Code, leading to potential information disclosure over a network. Impact and scope (as per metrics): CVSS 3.1 base score 6.5 (Medium); attack vector: NETWORK; attack complexity: LOW; privileg...

CVE-2026-45482

CVE-2026-45482 affects GitHub Copilot and Visual Studio Code (Copilot Chat extension): improper limitation of a pathname to a restricted directory enables a local attacker to bypass a security feature. Root cause is a path traversal issue in handling file paths. Impact is described as high for co...

CVE-2026-45496

The CVE-2026-45496 entry describes a path traversal vulnerability in Visual Studio Code where improper limitation of a pathname to a restricted directory allows local attackers to bypass a security feature. Affected component is Visual Studio Code (path handling/file access) with the root cause b...

CVE-2026-81376

CVE-2026-81376 affects Visual Studio Code and stems from an incomplete comparison with missing factors , allowing an unauthorized attacker to bypass a security feature over a network. The vulnerability is rated CVSS 9.6 (CRITICAL) with a changed scope, requiring user interaction but no prior auth...

CVE-2026-81381

CVE-2026-81381 is an information disclosure vulnerability in GitHub Copilot and Visual Studio Code , caused by insufficiently protected credentials. An unauthorized remote attacker can disclose sensitive information over the network with low complexity and no privileges required. NVD assigns a CV...

CVE-2026-70334

Visual Studio Code contains a security feature bypass caused by an incomplete list of disallowed inputs , allowing a local, unprivileged attacker (with user interaction) to circumvent a security control. The CVSS 3.1 score is 7.8 (HIGH) , reflecting high impact to confidentiality, integrity, and ...

CVE-2026-81357

CVE-2026-81357 is a server-side request forgery (SSRF) vulnerability in Visual Studio Code that allows an unauthorized attacker to bypass a security feature over a network . The vulnerability requires user interaction but no prior privileges, and has a CVSS 3.1 score of 8.2 (HIGH) with high confi...

CVE-2026-81356

Visual Studio Code is affected by an HTTP request/response smuggling vulnerability caused by inconsistent interpretation of HTTP requests. An unauthorized attacker can exploit this over a network to bypass a security feature , requiring user interaction. The Microsoft CVSS 3.1 score is 8.2 (HIGH)...

CVE-2026-81379

Visual Studio Code is vulnerable to a security feature bypass caused by not failing securely ("failing open"), allowing an unauthorized network attacker to bypass a security control with low complexity and no privileges, though user interaction is required . The CVSS 3.1 score is 8.2 (HIGH) with ...

CVE-2026-81383

Visual Studio Code is affected by an information disclosure vulnerability caused by the use of an incorrectly-resolved name or reference . An unauthorized network-based attacker can disclose information, with high confidentiality impact and changed scope (affecting other components). The attack r...

CVE-2026-78461

Visual Studio Code is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to bypass a security feature over a network. The flaw requires user interaction but no prior authentication. Per the CNA (Microsoft),...

CVE-2026-81377

Visual Studio Code is affected by a path traversal vulnerability that allows an unauthorized attacker to perform tampering over a network. The attack vector is network-based with low complexity and no required privileges, but user interaction is required . The impact is rated HIGH for integrity ,...

CVE-2026-78462

CVE-2026-78462 is an authorization bypass through a user-controlled key in Visual Studio Code that allows an unauthenticated network attacker to bypass a security feature . The underlying weakness is the use of a user-controllable key in an authorization check, enabling remote exploitation with l...

CVE-2026-81378

An interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network . The vulnerability is rated CVSS 3.1: 8.2 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N , indicating that exploitation requires user interaction , results in ...