PT-2026-58550

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An out-of-bounds read exists in Microsoft Office Excel, which allows an unauthorized attacker to disclose sensitive information locally through the use of malicious content...

PT-2026-58529

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A type confusion issue occurs when a resource is accessed using an incompatible type. This flaw allows an unauthorized attacker to execute arbitrary code locally on the system ...

PT-2026-58541

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A buffer over-read exists in Microsoft Office Excel, which could allow an unauthorized attacker to execute code locally. A buffer over-read occurs when a program reads more dat...

PT-2026-58545

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A heap-based buffer overflow exists in Microsoft Office Excel, which could allow an unauthorized attacker to execute arbitrary code locally on the system. This occurs when a us...

PT-2026-58519

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A use after free issue exists in Microsoft Office Excel. This occurs when an application continues to use a pointer after it has been freed, which can be exploited by an...

PT-2026-58299

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An untrusted pointer dereference allows an unauthorized attacker to perform local information disclosure. This issue occurs when the software accesses a memory address through ...

PT-2026-58557

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A heap-based buffer overflow exists in Microsoft Office Excel, which allows an unauthorized attacker to execute code locally. This issue can be triggered when a user opens a...

PT-2026-58584

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A stack-based buffer overflow exists in Microsoft Office Excel, which could allow an unauthorized attacker to execute code locally. This issue can be triggered when a user open...

PT-2026-58548

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An out-of-bounds read exists in Microsoft Office Excel, which allows an unauthorized attacker to execute code locally when a user opens a malicious file. Recommendations Apply...

Security Updates for Microsoft Office Online Server (July 2026)

The Microsoft Office Online Server or Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2026-47642,...

PT-2026-58579

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An untrusted pointer dereference allows an unauthorized attacker to execute code locally via a specially crafted spreadsheet. Recommendations At the moment, there is no...

PT-2026-58534

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A heap-based buffer overflow exists in Microsoft Office Excel, which could allow an unauthorized attacker to execute arbitrary code locally. A heap-based buffer overflow occurs...

PT-2026-58589

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A heap-based buffer overflow occurs when a program writes more data to a heap memory block than it can hold, potentially corrupting memory. This issue allows an unauthorized...

PT-2026-58544

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An integer underflow wrap or wraparound occurs when an arithmetic operation results in a value smaller than the minimum representable value for the data type, causing it to wra...

Security Updates for Microsoft Excel Products (July 2026)

The Microsoft Excel Products are missing a security update. They are, therefore, affected by multiple vulnerabilities: - Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. CVE-2026-55054 - Heap-based buffer overflow in Microsoft...

PYSEC-2026-2744 Open WebUI has stored XSS in Excel file preview

Summary Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheettohtml to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. Details The...

PT-2026-63656

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet affected versions not specified Description The OLE reader in PhpSpreadsheet follows sector chains from XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A malformed file can set the small-block depo...

EUVD-2026-42079

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not...

CVE-2026-46672

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not...

PT-2026-56159

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...