Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

89 records in Visual Studio Code · all components

TI-2020-01376 CVE-2020-1416 · GHSA-76cm-vv6x-f8wv

Improper privilege management in Microsoft Visual Studio 2019 version 16.6

Priority MEDIUM 47

An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.05862 Published 2020-07-14 No fix listed CWE-269
TI-2026-56172 CVE-2026-81376 · GHSA-x6gf-c826-8c9m

Visual Studio Code Security Feature Bypass Vulnerability

Priority MEDIUM 45

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.009 Published 2026-09-08 Fixed in 1.136.2 CWE-1023
TI-2024-29129 CVE-2024-43488 · GHSA-7459-m7qw-m8fw

Visual Studio Code extension for Arduino Remote Code Execution Vulnerability

Priority MEDIUM 45

Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01227 Published 2024-10-08 No fix listed CWE-306
TI-2026-34860 CVE-2026-47281 · GHSA-rgv4-j5p6-g338

Visual Studio Code Elevation of Privilege Vulnerability

Priority MEDIUM 44

Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00835 Published 2026-06-09 Fixed in 1.123.2 CWE-306
TI-2020-00581 CVE-2020-0604 · GHSA-hg8m-5gg6-3vv9

Visual Studio Code Remote Code Execution Vulnerability

Priority MEDIUM 44

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03623 Published 2020-08-17 Fixed in publication
TI-2026-17372 CVE-2026-21518

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Priority MEDIUM 43

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0144 Published 2026-02-10 Fixed in 0.37.1, 1.110.1 CWE-77
TI-2026-49153 CVE-2026-70336 · GHSA-29cx-mh6p-wj36

Visual Studio Code Remote Code Execution Vulnerability

Priority MEDIUM 42

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00817 Published 2026-08-11 Fixed in 1.132.1 CWE-94
TI-2026-48656 CVE-2026-69320 · GHSA-5948-chc9-3jrw

Visual Studio Code Remote Code Execution Vulnerability

Priority MEDIUM 42

Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00863 Published 2026-08-11 Fixed in 1.132.1 CWE-78
TI-2026-41090 CVE-2026-57102 · GHSA-3r7w-m284-m5r3

Visual Studio Code Security Feature Bypass Vulnerability

Priority MEDIUM 42

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00819 Published 2026-07-14 Fixed in 1.128.1 CWE-200
TI-2026-29743 CVE-2026-41109

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Priority MEDIUM 42

Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00861 Published 2026-05-12 Fixed in 1.128.1 CWE-74
TI-2020-13007 CVE-2020-17023 · GHSA-vwrg-gm47-cm4h

Visual Studio JSON Remote Code Execution Vulnerability

Priority MEDIUM 42

<p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.04619 Published 2020-10-16 Fixed in publication
TI-2020-12878 CVE-2020-16881 · GHSA-jq68-qcp2-fcqh

Visual Studio JSON Remote Code Execution Vulnerability

Priority MEDIUM 42

<p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.05365 Published 2020-09-11 Fixed in publication
TI-2018-00554 CVE-2018-0597 · GHSA-fjwh-37m4-wmr4

Untrusted search path in Microsoft The installer of Visual Studio Code

Priority MEDIUM 42

Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.05433 Published 2018-06-26 No fix listed CWE-426
Load more
Open these records in search →