{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"GCVE-110-NCSC-2026-473","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-10T19:38:38Z","dateUpdated":"","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"nl","value":"An untrusted search path vulnerability in Visual Studio Code allows unauthorized remote code execution over a network, posing significant security risks.","supportingMedia":null},{"lang":"nl","value":"A high-severity improper authentication vulnerability in ASP.NET Core Identity's password-reset and confirmation flows allows unauthorized attackers to elevate privileges and send emails to unvalidated addresses across multiple platforms and package versions.","supportingMedia":null},{"lang":"nl","value":"An authorization bypass vulnerability in Azure DevOps Server allows an authorized attacker to elevate privileges over a network by exploiting a user-controlled key.","supportingMedia":null},{"lang":"nl","value":"A missing authorization vulnerability in Visual Studio Code allows unauthorized attackers to disclose sensitive information over a network.","supportingMedia":null},{"lang":"nl","value":"An improper restriction of rendered UI layers or frames in Visual Studio Code allows a local unauthorized attacker to bypass a security feature, potentially compromising the application's security controls.","supportingMedia":null},{"lang":"nl","value":"Improper access control in the .NET framework allows an authorized local attacker to escalate their privileges, potentially compromising system security.","supportingMedia":null},{"lang":"nl","value":"Improper authentication in Azure DevOps allows an authorized attacker to remotely execute code over a network, posing significant security risks.","supportingMedia":null},{"lang":"nl","value":"A stack-based buffer overflow vulnerability in the .NET framework allows an unauthorized attacker to cause a denial of service over a network, potentially disrupting service availability.","supportingMedia":null},{"lang":"nl","value":"Improper encoding or escaping of output in ASP.NET Core can allow unauthorized attackers to disclose sensitive information over a network, posing a security risk.","supportingMedia":null},{"lang":"nl","value":"An inefficient algorithmic complexity vulnerability in ASP.NET Core allows unauthorized attackers to perform denial of service attacks over a network by exploiting resource-intensive operations.","supportingMedia":null},{"lang":"nl","value":"A cross-site request forgery (CSRF) vulnerability in ASP.NET Core allows unauthorized attackers to elevate privileges over a network, potentially compromising application security.","supportingMedia":null},{"lang":"nl","value":"A server-side request forgery (SSRF) vulnerability in Azure DevOps Server allows an authorized attacker to disclose sensitive information over a network.","supportingMedia":null},{"lang":"nl","value":"Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges remotely, potentially compromising system security.","supportingMedia":null},{"lang":"nl","value":"A memory release flaw in ASP.NET Core after its effective lifetime allows unauthorized attackers to cause denial of service over a network.","supportingMedia":null},{"lang":"nl","value":"Uncontrolled resource consumption vulnerability in ASP.NET Core allows unauthorized attackers to cause denial of service over a network by exhausting system resources.","supportingMedia":null},{"lang":"nl","value":"An uninitialized resource vulnerability in ASP.NET Core enables unauthorized attackers to disclose sensitive information over a network.","supportingMedia":null},{"lang":"nl","value":"Deserialization of untrusted data in Visual Studio can allow unauthorized attackers to remotely execute code, posing a critical security risk.","supportingMedia":null},{"lang":"nl","value":"A stack-based buffer overflow vulnerability in Visual Studio allows unauthorized remote attackers to execute arbitrary code over a network.","supportingMedia":null},{"lang":"nl","value":"A time-of-check time-of-use (TOCTOU) race condition vulnerability in .NET allows an authorized local attacker to elevate privileges by exploiting timing discrepancies between security checks and resource usage.","supportingMedia":null},{"lang":"nl","value":"Improper input validation in ASP.NET Core allows unauthorized attackers to bypass security features remotely, potentially compromising application security.","supportingMedia":null},{"lang":"nl","value":"A race condition caused by improper synchronization in ASP.NET Core allows an authorized attacker to locally escalate privileges by exploiting concurrent execution with shared resources.","supportingMedia":null},{"lang":"nl","value":"A heap-based buffer overflow vulnerability in Visual Studio allows unauthorized remote attackers to execute arbitrary code over a network.","supportingMedia":null},{"lang":"nl","value":"A user interface misrepresentation vulnerability in Visual Studio Code allows an unauthorized attacker to bypass security features over a network, potentially compromising application integrity.","supportingMedia":null},{"lang":"nl","value":"An improper authentication vulnerability in ASP.NET Core allows unauthorized attackers to elevate privileges remotely over a network, potentially compromising system security.","supportingMedia":null},{"lang":"nl","value":"A failure to securely handle errors ('failing open') in .NET allows unauthorized attackers to bypass security controls over a network, potentially compromising system integrity.","supportingMedia":null},{"lang":"nl","value":"An inefficient algorithmic complexity vulnerability in .NET allows unauthorized attackers to conduct denial of service attacks over a network by exploiting resource exhaustion.","supportingMedia":null},{"lang":"nl","value":"Unrestricted resource allocation in ASP.NET Core can allow unauthorized attackers to cause network-based denial of service conditions by exhausting system resources.","supportingMedia":null},{"lang":"nl","value":"Improper neutralization of input during web page generation in Visual Studio Code allows unauthorized attackers to execute code remotely over a network.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in the GitHub Pull Requests and Issues Extension for Visual Studio Code allows unauthorized attackers to disclose information via external control of file name or path.","supportingMedia":null},{"lang":"nl","value":"A missing authentication mechanism in Visual Studio Code allows an authorized local attacker to elevate their privileges.","supportingMedia":null},{"lang":"nl","value":"An incorrect authorization vulnerability in Visual Studio Code allows unauthorized attackers to bypass security features over a network, potentially compromising system integrity.","supportingMedia":null},{"lang":"nl","value":"A server-side request forgery (SSRF) vulnerability in Visual Studio Code allows unauthorized attackers to bypass security features over a network, potentially leading to unauthorized access or actions.","supportingMedia":null},{"lang":"nl","value":"An incorrect authorization vulnerability in Visual Studio Code enables unauthorized attackers to execute code remotely over a network.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in .NET Aspire involving the creation of temporary files with insecure permissions allows authorized local attackers to elevate privileges.","supportingMedia":null},{"lang":"nl","value":"Improper control of code generation in Visual Studio Code allows unauthorized remote attackers to execute arbitrary code over a network.","supportingMedia":null},{"lang":"nl","value":"An improper access control vulnerability in Visual Studio Code allows unauthorized remote attackers to execute arbitrary code over a network.","supportingMedia":null},{"lang":"nl","value":"An improper control of code generation vulnerability in Visual Studio Code allows an unauthorized local attacker to bypass security features via code injection.","supportingMedia":null},{"lang":"nl","value":"An incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature remotely over a network.","supportingMedia":null},{"lang":"nl","value":"An incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to locally bypass a security feature, potentially compromising the intended security controls.","supportingMedia":null},{"lang":"nl","value":"Improper neutralization of special elements in commands within Visual Studio Code can enable unauthorized local code execution by attackers.","supportingMedia":null},{"lang":"nl","value":"A trust boundary violation vulnerability in Visual Studio Code allows an unauthorized attacker to bypass security features over a network, potentially compromising system integrity.","supportingMedia":null}],"references":[{"url":"https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0473.json","name":"","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-us/security-guidance","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70094.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70175.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85923.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102230.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102236.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105544.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109467.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109475.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109476.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109478.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109481.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112745.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114146.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114147.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114149.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114150.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114151.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114152.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114154.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114155.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114156.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114157.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114158.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114159.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114171.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118741.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118745.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118746.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118747.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118748.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118749.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118750.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119975.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119976.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119981.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119982.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119983.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119985.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-120778.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-120779.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-120780.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-120782.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-120796.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-121660.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-121661.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-121662.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-121663.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-121664.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-121665.json","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:U/RL:O/RC:C","baseScore":8.8,"baseSeverity":"HIGH"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Untrusted Search Path","cweId":"CWE-426","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Weak Password Recovery Mechanism for Forgotten Password","cweId":"CWE-640","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Authorization Bypass Through User-Controlled Key","cweId":"CWE-639","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Missing Authorization","cweId":"CWE-862","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Restriction of Rendered UI Layers or Frames","cweId":"CWE-1021","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Stack-based Buffer Overflow","cweId":"CWE-121","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Encoding or Escaping of Output","cweId":"CWE-116","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Inefficient Algorithmic Complexity","cweId":"CWE-407","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Cross-Site Request Forgery","cweId":"CWE-352","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Server-Side Request Forgery","cweId":"CWE-918","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Incorrect Authorization","cweId":"CWE-863","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Missing Release of Memory after Effective Lifetime","cweId":"CWE-401","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Allocation of Resources Without Limits or Throttling","cweId":"CWE-770","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Use of Uninitialized Resource","cweId":"CWE-908","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Time-of-check Time-of-use (TOCTOU) Race Condition","cweId":"CWE-367","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Resolution of Path Equivalence","cweId":"CWE-41","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Concurrent Execution using Shared Resource with Improper Synchronization","cweId":"CWE-362","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Heap-based Buffer Overflow","cweId":"CWE-122","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"User Interface (UI) Misrepresentation of Critical Information","cweId":"CWE-451","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Not Failing Securely","cweId":"CWE-636","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Input During Web Page Generation","cweId":"CWE-79","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"External Control of File Name or Path","cweId":"CWE-73","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Missing Authentication for Critical Functionality","cweId":"CWE-306","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Creation of Temporary File in Directory with Insecure Permissions","cweId":"CWE-379","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Control of Generation of Code","cweId":"CWE-94","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Incomplete List of Disallowed Inputs","cweId":"CWE-184","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Special Elements used in a Command","cweId":"CWE-77","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Trust Boundary Violation","cweId":"CWE-501","type":"CWE"}]}],"affected":[{"vendor":"Microsoft","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["CVE-2026-102230","CVE-2026-102236","CVE-2026-105544","CVE-2026-109467","CVE-2026-109475","CVE-2026-109476","CVE-2026-109478","CVE-2026-109481","CVE-2026-112745","CVE-2026-114146","CVE-2026-114147","CVE-2026-114149","CVE-2026-114150","CVE-2026-114151","CVE-2026-114152","CVE-2026-114154","CVE-2026-114155","CVE-2026-114156","CVE-2026-114157","CVE-2026-114158","CVE-2026-114159","CVE-2026-114171","CVE-2026-118741","CVE-2026-118745","CVE-2026-118746","CVE-2026-118747","CVE-2026-118748","CVE-2026-118749","CVE-2026-118750","CVE-2026-119975","CVE-2026-119976","CVE-2026-119981","CVE-2026-119982","CVE-2026-119983","CVE-2026-119985","CVE-2026-120778","CVE-2026-120779","CVE-2026-120780","CVE-2026-120782","CVE-2026-120796","CVE-2026-121660","CVE-2026-121661","CVE-2026-121662","CVE-2026-121663","CVE-2026-121664","CVE-2026-121665","CVE-2026-70094","CVE-2026-70175","CVE-2026-85923"]}},"adp":null}}