CVE-2026-121660

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-121661

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-121663

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-121665

Visual Studio Code Security Feature Bypass Vulnerability

Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-120782

Visual Studio Code Security Feature Bypass Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-114147

ASP.NET Core Denial of Service Vulnerability

Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 14 more

CVE-2026-114171

Visual Studio Code Security Feature Bypass Vulnerability

User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-121662

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-121664

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-119983

Visual Studio Code Security Feature Bypass Vulnerability

Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-114146

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 13 more

CVE-2026-114149

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 13 more

CVE-2026-114154

ASP.NET Core Denial of Service Vulnerability

Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Windows .net 8.0 Installed On Windows .net 9.0 Installed On Windows and 4 more

CVE-2026-114157

ASP.NET Core Security Feature Bypass Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Windows .net 11.0 Installed On Windows .net 8.0 Installed On Windows and 4 more

CVE-2026-109476

ASP.NET Core Information Disclosure Vulnerability

Improper encoding or escaping of output in ASP.NET Core allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 12 more

CVE-2026-109478

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.net 8.0 Installed On Linux .net 8.0 Installed On Mac Os .net 8.0 Installed On Windows and 6 more

CVE-2026-119982

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-119981

Visual Studio Code Elevation of Privilege Vulnerability

Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-119976

Visual Studio Code GitHub Pull Requests and Issues Extension Information Disclosure Vulnerability

External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code

CVE-2026-119975

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio Code