| CVE-2026-47285 | MITTEL6.5 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 11/08/2026 |
| CVE-2026-57102 | HOCH8.8 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 14/07/2026 |
| CVE-2026-57101 | MITTEL6.1 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 14/07/2026 |
| CVE-2026-50520 | HOCH8.4 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally. | 14/07/2026 |
| CVE-2026-47282 | MITTEL6.5 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 14/07/2026 |
| CVE-2026-45496 | MITTEL5.5 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 14/07/2026 |
| CVE-2026-48569 | MITTEL5.5 | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 09/06/2026 |
| CVE-2026-47292 | HOCH7.8 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally. | 09/06/2026 |
| CVE-2026-47287 | MITTEL6.5 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | 09/06/2026 |
| CVE-2026-47284 | MITTEL6.5 | Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | 09/06/2026 |
| CVE-2026-47281 | KRITISCH9.6 | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | 09/06/2026 |
| CVE-2026-45482 | HOCH8.4 | Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 09/06/2026 |
| CVE-2026-40376 | HOCH8.1 | Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | 09/06/2026 |
| CVE-2026-41613 | HOCH8.8 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | 12/05/2026 |
| CVE-2026-41611 | NIEDRIG3.3 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. | 12/05/2026 |
| CVE-2026-41610 | MITTEL5.0 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 12/05/2026 |
| CVE-2026-41109 | HOCH8.8 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network. | 12/05/2026 |
| CVE-2026-21523 | HOCH8.0 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. | 10/02/2026 |
| CVE-2026-21518 | HOCH8.8 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 10/02/2026 |
| CVE-2025-64660 | HOCH8.0 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. | 20/11/2025 |