CVE-2026-120780

HighCVSS 8.3/10Last modified Nov 10, 2026

Description

Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1207827.8Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security featureCVE-2026-1207836.4Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1207858.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207868.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207888.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207898.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-120796.5The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and includinCVE-2026-1207908.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207918.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207927.3Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.CVE-2026-1207965.3Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-12084.3The Friendly Functions for Welcart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.
CVE-2026-120780: High severity, CVSS 8.3 | Vulnix