Visual Studio Code
Records
10
Disclosed CVEs
10
Exploited (sev 3–4)
0
CISA KEV flagged
0
Newest record 2026-09-08 · 10 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Patch now: confirmed exploitation or KEV · 0
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
No record for Visual Studio Code has confirmed exploitation or a KEV flag.
Disclosures by month · last 24 months
█ ▄ ▄ █▄▄█
Nov ’2410 disclosed · peak 2 in Nov ’25Oct ’26
Disclosed CVEs, no confirmed exploitation · 10
- 2026-09-08CVE-2026-81381GitHub Copilot and Visual Studio Code vulnerable to credential disclosure2 Disclosedcredential-disclosure · github-copilot
- 2026-09-08CVE-2026-81380CVE-2026-81380: GitHub Copilot and VS Code command injection vulnerability2 Disclosedgithub-copilot · command-injection
- 2026-08-11CVE-2026-70335CVE-2026-70335: OS command injection vulnerability in GitHub Copilot and Visual Studio Code2 Disclosedgithub-copilot · command-injection
- 2026-07-14CVE-2026-47282CVE-2026-47282: Credential disclosure vulnerability in GitHub Copilot2 Disclosedcredential-disclosure
- 2026-06-19CVE-2026-50519CVE-2026-50519: Insecure resource default in GitHub Copilot and VS Code allows info disclosure2 Disclosedinfra_vuln
- 2026-06-09CVE-2026-45482CVE-2026-45482: Path Traversal Vulnerability in GitHub Copilot and VS Code2 Disclosedpath_traversal
- 2026-04-14CVE-2026-23653CVE-2026-23653: Command Injection Flaw in GitHub Copilot and VS Code2 Disclosedgithub-copilot · command-injection
- 2026-02-10CVE-2026-21518CVE-2026-21518: Command Injection Vulnerability in GitHub Copilot and VS Code2 Disclosedgithub-copilot · command-injection
- 2025-11-20CVE-2025-64660CVE-2025-64660: GitHub Copilot and VS Code Access Control Vulnerability2 Disclosedaccess-control · remote-code-execution
- 2025-11-11CVE-2025-62453CVE-2025-62453: GitHub Copilot and VS Code Generative AI Output Validation Flaw2 Disclosedoutput-validation · security-bypass
This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.