Microsoft Visual Studio 2026 Version 18.10 vulnerabilities
44 known vulnerabilities affecting microsoft/microsoft_visual_studio_2026_version_18.10.
Total CVEs
44
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH32MEDIUM9
Vulnerabilities
Page 2 of 3
CVE-2026-96230P3HIGHCVSS 8.8≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96230 [HIGH] CWE-79 CVE-2026-96230: Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-69651P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-69651 [HIGH] CWE-407 CVE-2026-69651: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-70181P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-70181 [HIGH] CWE-770 CVE-2026-70181: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-70159P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-70159 [HIGH] CWE-770 CVE-2026-70159: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-96231P3HIGHCVSS 7.8≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96231 [HIGH] CWE-59 CVE-2026-96231: Improper link resolution before file access ('link following') in .NET allows an authorized attacker
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-96225P3HIGHCVSS 7.8≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96225 [HIGH] CWE-59 CVE-2026-96225: Improper link resolution before file access ('link following') in .NET allows an authorized attacker
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-70186P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-70186 [HIGH] CWE-833 CVE-2026-70186: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-109468P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-15
CVE-2026-109468 [HIGH] CWE-770 CVE-2026-109468: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-96222P3HIGHCVSS 7.4≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96222 [HIGH] CWE-295 CVE-2026-96222: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthoriz
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-58280P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-58280 [HIGH] CWE-674 CVE-2026-58280: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-96236P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96236 [HIGH] CWE-770 CVE-2026-96236: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-84008P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-84008 [HIGH] CWE-407 CVE-2026-84008: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-96232P3HIGHCVSS 7.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96232 [HIGH] CWE-125 CVE-2026-96232: Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-70190P3HIGHCVSS 7.3≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-70190 [HIGH] CWE-59 CVE-2026-70190: Improper link resolution before file access ('link following') in .NET allows an authorized attacker
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-70161P3HIGHCVSS 7.3≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-70161 [HIGH] CWE-22 CVE-2026-70161: Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an aut
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-70194P3MEDIUMCVSS 6.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-70194 [MEDIUM] CWE-295 CVE-2026-70194: Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a securi
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2026-85790P3MEDIUMCVSS 5.9≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-85790 [MEDIUM] CWE-416 CVE-2026-85790: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a netw
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-96229P3MEDIUMCVSS 6.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96229 [MEDIUM] CWE-183 CVE-2026-96229: Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information ov
Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-96238P3MEDIUMCVSS 6.5≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-96238 [MEDIUM] CWE-346 CVE-2026-96238: Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2026-70165P3MEDIUMCVSS 6.7≥ 18.10.0, < 18.10.42026-10-13
CVE-2026-70165 [MEDIUM] CWE-59 CVE-2026-70165: Improper link resolution before file access ('link following') in .NET allows an authorized attacker
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
nvd