CVE-2026-121660

HighCVSS 7.5/10Last modified Nov 11, 2026

Description

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-184

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1216617.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1216628.6Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker toCVE-2026-1216638.8Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216648.3Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker tCVE-2026-1216658.8Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1216687.7Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.CVE-2026-1216696.1Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.CVE-2026-121677.8The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver funCVE-2026-1216707.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized aCVE-2026-1216717.0Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-1216737.8Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.CVE-2026-1216746.1Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over
CVE-2026-121660: High severity, CVSS 7.5 | Vulnix