Microsoft Visual Studio 2026 Version 18.10 (Microsoft) - vulnerabilities (CVEs)

44 CVEs, 44 in the last 30 days, 1 known versions, newest CVE from 2026-10-15. Vendor: Microsoft.

CVEs of Microsoft Visual Studio 2026 Version 18.10

CVE-2026-109468 - CVSS 7.5 (high), 2026-10-15: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-105016 - CVSS 9.8 (critical), 2026-10-13: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
CVE-2026-70162 - CVSS 5.9 (medium), 2026-10-13: A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited…
CVE-2026-102869 - CVSS 8.8 (high), 2026-10-13: Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-102870 - CVSS 8.8 (high), 2026-10-13: Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
CVE-2026-58280 - CVSS 7.5 (high), 2026-10-13: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96957 - CVSS 8.8 (high), 2026-10-13: Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96235 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-96238 - CVSS 6.5 (medium), 2026-10-13: Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96230 - CVSS 8.8 (high), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a…
CVE-2026-96234 - CVSS 5.3 (medium), 2026-10-13: Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-96237 - CVSS 7.5 (high), 2026-10-13: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-96229 - CVSS 6.5 (medium), 2026-10-13: Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-96232 - CVSS 7.5 (high), 2026-10-13: Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-96225 - CVSS 7.8 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96231 - CVSS 7.8 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-84008 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-83520 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70035 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-70007 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
CVE-2026-85363 - CVSS 8.8 (high), 2026-10-13: Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-88092 - CVSS 9.4 (critical), 2026-10-13: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a…
CVE-2026-96236 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-96224 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-96222 - CVSS 7.4 (high), 2026-10-13: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-70196 - CVSS 5.9 (medium), 2026-10-13: Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70159 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70165 - CVSS 6.7 (medium), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70179 - CVSS 7.5 (high), 2026-10-13: Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-70194 - CVSS 6.5 (medium), 2026-10-13: Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-70175 - CVSS 8.1 (high), 2026-10-13: Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-70183 - CVSS 7.5 (high), 2026-10-13: Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate…
CVE-2026-70190 - CVSS 7.3 (high), 2026-10-13: Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70197 - CVSS 8.1 (high), 2026-10-13: Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-70161 - CVSS 7.3 (high), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-70181 - CVSS 7.5 (high), 2026-10-13: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70188 - CVSS 9.1 (critical), 2026-10-13: Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature…
CVE-2026-70186 - CVSS 7.5 (high), 2026-10-13: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70174 - CVSS 8.8 (high), 2026-10-13: Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-87697 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-85790 - CVSS 5.9 (medium), 2026-10-13: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-69651 - CVSS 7.5 (high), 2026-10-13: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-66822 - CVSS 5.9 (medium), 2026-10-13: Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-103572 - CVSS 8.8 (high), 2026-10-13: Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized…