Known vulnerabilities in Visual Studio Code

Vendor: Microsoft
Software CPE: cpe:2.3:a:microsoft:vscode:*:*:*:*:*:*:*:*
Total vulnerabilities: 70
Public exploits: 4
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Visual Studio Code Visual Studio Code is affected by 70 known vulnerabilities: 1 critical, 35 high, 18 medium, 16 low Critical High Medium Low

Vulnerabilities (70)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141863 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-70336
CWE-94 High
No
No
1.132.1 12.08.2026 SB20260812229
#VU141862 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-70335
CWE-78 High
No
No
1.132.1 12.08.2026 SB20260812229
#VU141837 - Not Failing Securely (\'Failing Open\')
CVE-2026-69306
CWE-636 High
No
No
1.132.1 12.08.2026 SB20260812229
#VU141836 - Incorrect Authorization
CVE-2026-69278
CWE-863 High
No
No
1.132.1 12.08.2026 SB20260812229
#VU141835 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-69320
CWE-78 High
No
No
1.132.1 12.08.2026 SB20260812229
#VU141738 - Command injection
CVE-2026-47285
CWE-77 Medium
No
No
1.132.1 12.08.2026 SB20260812229
#VU141737 - Missing Authorization
CVE-2026-59113
CWE-862 High
No
No
1.132.1 12.08.2026 SB20260812229
#VU141733 - Authorization Bypass Through User-Controlled Key
CVE-2026-58650
CWE-639 High
No
No
1.132.1 12.08.2026 SB20260812229
#VU138173 - Inclusion of Functionality from Untrusted Control Sphere
CVE-2026-57102
CWE-829 Medium
No
No
1.128.1 17.07.2026 SB2026071709
#VU138172 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-57101
CWE-79 Medium
No
No
1.128.1 17.07.2026 SB2026071709
#VU138171 - Command injection
CVE-2026-50520
CWE-77 Low
No
No
1.128.1 17.07.2026 SB2026071709
#VU138170 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-45496
CWE-22 Low
No
No
1.128.1 17.07.2026 SB2026071709
#VU138169 - Insufficiently Protected Credentials
CVE-2026-47282
CWE-522 Medium
No
No
1.128.1 17.07.2026 SB2026071709
#VU134269 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-48569
CWE-22 Medium
No
No
1.119.1 10.06.2026 SB20260610109
#VU134268 - Exposure of sensitive information to an unauthorized actor
CVE-2026-47284
CWE-200 Medium
No
No
1.123.2 10.06.2026 SB20260610110
#VU134267 - Improper input validation
CVE-2026-47281
CWE-20 High
No
No
1.123.2 10.06.2026 SB20260610110
#VU134266 - Improper input validation
CVE-2026-40376
CWE-20 High
No
No
1.119.1 10.06.2026 SB20260610109
#VU134265 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-47287
CWE-22 Medium
No
No
1.123.2 10.06.2026 SB20260610110
#VU131371 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-41109
CWE-74 High
No
No
1.119.1 13.05.2026 SB2026051389
#VU131298 - Session Fixation
CVE-2026-41613
CWE-384 High
No
No
1.119.1 13.05.2026 SB2026051309


Showing elements 1 - 20 out of 70