OV
Product
Open Vsx
4
CVEs
0
On KEV
8.7
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 3Low 0
Watch
Add Open Vsx to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-13323 | 8.7 | Jul 1 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or… Affected: before 1.0.2 |
| CVE-2026-4983 | 5.4 | Jun 23 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as… Affected: 0.1.0 before 0.34.1 |
| CVE-2025-6705 | 5.3 | Jun 27 | A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions Affected: All versions, or not specified |
| CVE-2025-1007 | 5.3 | Feb 19 | In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or … Affected: 0.9.0 before 0.19.1 |
Showing 4