VS
Product
Visual Studio Code
98
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 5High 73Medium 19Low 1
Watch
Add Visual Studio Code to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-28471 | 7.8 | Apr 13 | Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability Affected: before 1.55.2 |
| CVE-2021-28469 | 7.8 | Apr 13 | Visual Studio Code Remote Code Execution Vulnerability Affected: before 1.55.2 |
| CVE-2021-28457 | 7.8 | Apr 13 | Visual Studio Code Remote Code Execution Vulnerability Affected: before 1.55.2 |
| CVE-2021-27060 | 7.8 | Mar 11 | Visual Studio Code Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2020-17148 | 7.8 | Dec 10 | Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability Affected: before 0.61.0 |
| CVE-2020-17104 | 7.8 | Nov 11 | Visual Studio Code JSHint Extension Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2020-17023 | 7.8 | Oct 16 | <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file Affected: All versions, or not specified |
| CVE-2020-16881 | 7.8 | Sep 11 | <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file Affected: before 1.48.1 |
| CVE-2020-0604 | 7.8 | Aug 17 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project Affected: before 0.24.0 |
| CVE-2019-1414 | 7.8 | Jan 24 | An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege… Affected: before 1.39 |
| CVE-2019-0728 | 7.8 | Mar 5 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution… Affected: All versions, or not specified |
| CVE-2018-0597 | 7.8 | Jun 26 | Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory Affected: All versions, or not specified |
| CVE-2026-102231 | 7.7 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2026-81381 | 7.5 | Sep 8 | GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2026-102234 | 7.4 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2026-81383 | 7.4 | Sep 8 | Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2026-78461 | 7.4 | Sep 8 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2022-41042 | 7.4 | Oct 11 | Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.72.1 |
| CVE-2025-26631 | 7.3 | Mar 11 | Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally Affected: before 1.98.0 |
| CVE-2025-24042 | 7.3 | Feb 11 | Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability Affected: before 1.97.1 |
| CVE-2025-24039 | 7.3 | Feb 11 | Visual Studio Code Elevation of Privilege Vulnerability Affected: before 1.97.1 |
| CVE-2022-38020 | 7.3 | Sep 13 | Visual Studio Code Elevation of Privilege Vulnerability Affected: All versions, or not specified |
| CVE-2022-26921 | 7.3 | Apr 15 | Visual Studio Code Elevation of Privilege Vulnerability Affected: 1.0.0 before 1.66.2 |
| CVE-2025-21264 | 7.1 | May 13 | Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally Affected: before 1.100.1 |
| CVE-2026-102232 | 7.0 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2021-28477 | 7.0 | Apr 13 | Visual Studio Code Remote Code Execution Vulnerability Affected: before 1.55.2 |
| CVE-2021-1639 | 7.0 | Feb 25 | Visual Studio Code Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2020-16977 | 7.0 | Oct 16 | <p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file Affected: All versions, or not specified |
| CVE-2026-102229 | 6.8 | Oct 13 | Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2025-32726 | 6.8 | Apr 12 | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally Affected: before 1.99.1 |
| CVE-2023-33144 | 6.6 | Jun 14 | Visual Studio Code Spoofing Vulnerability Affected: before 1.79 |
| CVE-2023-29338 | 6.6 | May 9 | Visual Studio Code Spoofing Vulnerability Affected: before 1.78.1 |
| CVE-2026-81377 | 6.5 | Sep 8 | Visual Studio Code Tampering Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2026-47285 | 6.5 | Aug 11 | Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.132.1 |
| CVE-2026-47282 | 6.5 | Jul 14 | GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.128.1 |
| CVE-2026-47284 | 6.5 | Jun 9 | Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.123.2 |
| CVE-2026-47287 | 6.5 | Jun 9 | Visual Studio Code Tampering Vulnerability Affected: 1.0.0 before 1.123.2 |
| CVE-2026-102851 | 6.1 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2026-57101 | 6.1 | Jul 14 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.128.1 |
| CVE-2022-24526 | 6.1 | Mar 9 | Visual Studio Code Spoofing Vulnerability Affected: before 1.65.2 |
| CVE-2026-81380 | 5.9 | Sep 8 | GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2026-45496 | 5.5 | Jul 14 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.128.1 |
| CVE-2026-48569 | 5.5 | Jun 9 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.123.2 |
| CVE-2021-26437 | 5.5 | Sep 15 | Visual Studio Code Spoofing Vulnerability Affected: All versions, or not specified |
| CVE-2026-41610 | 5.0 | May 12 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.119.1 |
| CVE-2025-62453 | 5.0 | Nov 11 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally Affected: before 1.105.0 |
| CVE-2021-43908 | 4.3 | Dec 15 | Visual Studio Code Spoofing Vulnerability Affected: 1.0.0 before 1.63.1 |
| CVE-2026-41611 | 3.3 | May 12 | Visual Studio Code Remote Code Execution Vulnerability Affected: 1.0.0 before 1.119.1 |