CVE-2026-70355

CVE-2026-70355 affects Microsoft Office SharePoint/SharePoint Server; improper neutralization of input during web page generation (XSS) could allow an authorized attacker to elevate privileges over the network. The CVSSv3.1 base score is 7.3 (HIGH) with NETWORK attack vector, LOW attack complexit...

CVE-2008-3006

Microsoft Excel could allow remote code execution via memory corruption in the BIFF COUNTRY record parsing bug. Affected products include Excel 2000 SP3, 2002 SP3, 2003 SP2/SP3, 2007 Gold/SP1; Excel Viewer; Office Compatibility Pack 2007 Gold/SP1; Office for Mac (2004/2008); and SharePoint Server...

CVE-2010-0716

Affected software : Microsoft SharePoint (Documents module). Vulnerability : Cross-site scripting via _layouts/Upload.aspx when uploading files (same-hostname/port used for primary files and attachments). Root cause : same-origin relationship leveraged to inject script in uploaded TXT files; requ...

CVE-2014-6357

CVE-2014-6357 is a use-after-free remote code execution vulnerability reported in Microsoft Office products (Office 2010 SP2, Office 2013 SP1/Gold, Office for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2/2013) and related Office Web ...

CVE-2015-0064

CVE-2015-0064 corresponds to a memory-corruption remote-code-execution vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer and Office Compatibility Pack SP3. The issue arises when processing a crafte...

CVE-2018-8156

CVE-2018-8156 is a Microsoft SharePoint Server elevation-of-privilege issue. Connected sources confirm the vulnerability arises when SharePoint Server (and related Project Server variants) fails to properly filter specially crafted web requests, enabling an attacker to escalate privileges. Severa...

CVE-2026-40357

Technical details for CVE-2026-40357 are not publicly available in the provided documents. Monitor for updates from Microsoft and CVE records.

CVE-2013-3889

This CVE (CVE-2013-3889) corresponds to a memory corruption vulnerability in Microsoft Excel and related Office components. The affected products include Excel 2007 SP3, 2010 SP1/SP2, 2013 and RT, Office 2007 SP3, 2010 SP1/SP2, 2013/RT, Office for Mac 2011, Excel Viewer, Office Compatibility Pack...

CVE-2018-8252

CVE-2018-8252 affects Microsoft SharePoint Server. The connected documents describe an elevation-of-privilege flaw caused by the server not properly sanitizing or filtering specially crafted web requests, allowing a remote attacker to gain elevated privileges. The vulnerability is associated with...

CVE-2025-54906

CVE-2025-54906 affects Microsoft Office (notably Excel) and allows local code execution due to a memory-management issue described as a “Free of memory not on the heap in Microsoft Office.” Connected sources confirm multiple Office components (Word/Excel) are affected and cite updates that fix th...

CVE-2026-55132

Microsoft Word/Office vulnerability CVE-2026-55132 involves a double-free in Word that could allow a local attacker to execute arbitrary code. Affected product: Microsoft Word (Office suite). Root cause: memory management flaw (double free) in Word’s handling of certain documents. Impact: local c...

CVE-2014-2816

CVE-2014-2816 affects Microsoft SharePoint Server 2013 (Gold/SP1) and SharePoint Foundation 2013 (Gold/SP1). The vulnerability allows remote authenticated users to gain privileges via a Trojan horse app that runs a custom action in the SharePoint extensibility model (SharePoint Page Content Vulne...

CVE-2015-2556

CVE-2015-2556 is an information-disclosure vulnerability affecting Microsoft SharePoint Server 2007 SP3 and 2010 SP2, arising from how the InfoPath Forms Services component parses DTDs. The root cause is improper handling of XML External Entities (XXE), allowing a remote attacker to read arbitrar...

CVE-2016-0053

CVE-2016-0053 corresponds to a memory corruption vulnerability that allows remote code execution when processing crafted Office documents in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automa...

CVE-2024-49064

CVE-2024-49064 corresponds to a Microsoft SharePoint Information Disclosure Vulnerability. Public documents describe an information disclosure issue in SharePoint that could lead to exposure of sensitive data. Affected products include Microsoft SharePoint Server/SharePoint Enterprise Server vari...

CVE-2013-1289

The CVE-2013-1289 entry covers a cross-site scripting (XSS) vulnerability in multiple Microsoft HTML Sanitization components used by SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1. The issue arises from the HTML sanitization logic,...

CVE-2026-45485

CVE-2026-45485: In Microsoft Office, an out-of-bounds read leads to local information disclosure. Documents confirm the vulnerability and its impact (local disclosure) with low severity (CVSS 3.1:3.3). Exploitation details and affected component/version specifics are not provided in the supplied ...

CVE-2026-56192

The CVE-2026-56192 entry describes a local, information-disclosure vulnerability in Microsoft Office caused by an out-of-bounds read. Affected product: Microsoft Office suite (Office components) per multiple connected sources. Root cause and exact vulnerable component are not fully detailed in th...

CVE-2013-1290

CVE-2013-1290 affects Microsoft SharePoint Server 2013 in configurations using legacy My Sites, where default access controls for a SharePoint list are not properly enforced. This allows remote authenticated users to disclose list item data by directly requesting a list’s location, i.e., informat...

CVE-2013-3857

CVE-2013-3857 affects Microsoft Word/Office components across SharePoint, Word Web App, Word Viewer, and older Word releases (2003–2010) with Word Memory Corruption via crafted documents. Root cause: memory corruption enabling remote code execution or DoS. Affected/impacted products include Word ...

CVE-2017-8654

CVE-2017-8654 affects Microsoft SharePoint Server 2010 SP2; an XSS vulnerability arises when the server fails to properly sanitize specially crafted web requests. Exploitation could allow an attacker to run script in the user's browser (read/alter content, potentially impersonate user actions). R...

CVE-2025-53760

CVE-2025-53760 is a Microsoft SharePoint elevation-of-privilege vulnerability described as an SSRF issue that can allow an authorized attacker to gain elevated privileges over a network. The CVSS v3.1 score is 7.1 (HIGH) with Network attack vector, low attack complexity, and privileges required: ...

CVE-2026-48562

Summary: CVE-2026-48562 affects Microsoft Office SharePoint Server. It describes improper neutralization of input during web page generation, causing cross-site scripting that could enable an authorized attacker to perform spoofing over a network. The associated metrics assign a CVSS v3.1 base sc...

CVE-2026-55032

CVE-2026-55032 is a Microsoft Word remote code execution vulnerability reported as a use-after-free issue in Microsoft Office Word. The CVE entry specifies local attack vector with user interaction required, yielding a high severity (CVSS 3.1: 7.8, HIGH) and potential for arbitrary code execution...

CVE-2026-55121

CVE-2026-55121 corresponds to an out-of-bounds read in Microsoft Office that enables an unauthenticated or authorized local attacker to disclose information. The public descriptions across NVD/MSRC and EUVD notes indicate the vulnerability affects Microsoft Office components and results in local ...

CVE-2025-54897

CVE-2025-54897 is a Microsoft SharePoint remote code execution vulnerability caused by deserialization of untrusted data, enabling an authorized attacker to execute code over the network. The CVSSv3.1 base score is 8.8 ( HIGH ), with network access, low attack complexity, and low privileges requi...

CVE-2026-64901

CVE-2026-64901 involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to execute code over the network. The vulnerability affects Microsoft SharePoint Server components as described in the CVE entries; the underlying issue is untrusted-deseriali...

CVE-2026-65660

CVE-2026-65660 is a code injection vulnerability in Microsoft Office SharePoint that allows an authorized attacker to perform spoofing over a network, per the NVD entry. Microsoft's own advisory characterizes the impact as remote code execution . The Microsoft CNA CVSS 3.1 score is 8.8 (High) , w...

CVE-2026-70324

CVE-2026-70324 describes a server-side request forgery (SSRF) in Microsoft Office SharePoint that allows an authorized attacker to elevate privileges over a network. Affected product: SharePoint server components; root cause is SSRF enabling privilege escalation. The CVSSv3.1 score is 8.8 (HIGH) ...

CVE-2008-5026

CVE-2008-5026 involves Microsoft SharePoint, where the Documents module allows uploading files using the same hostname/port as the site’s primary files. This enables remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) by uploading HTML documents...

CVE-2011-1989

CVE-2011-1989 corresponds to a vulnerability in Microsoft Excel and related Office components where conditional expressions used for formatting could be parsed incorrectly. A crafted spreadsheet could lead to remote code execution. Affected products include Excel 2003 SP3, 2007 SP2, 2010 SP1, Off...

CVE-2015-6037

CVE-2015-6037 is an XSS vulnerability affecting Microsoft Office Web Apps/Excel Services across SharePoint Server 2010 SP2, SharePoint 2013 SP1, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1 and SharePoint Foundation 2013 SP1. The issue allows remote authenticated users to inject arbitr...

CVE-2026-26113

CVE-2026-26113 is a Microsoft Office remote code-execution vulnerability caused by an untrusted pointer dereference. The issue is addressed in the March 2026 Patch Tuesday updates for Office; affected products are patched by Microsoft through the updates referenced by the vulnerability entry. The...

CVE-2026-45468

CVE-2026-45468 involves an improper neutralization of input during web page generation (XSS) in Microsoft Office SharePoint / SharePoint Server . An authorized attacker can perform spoofing over a network by targeting affected SharePoint web pages. The CVSS 3.1 base score is 4.6 (Medium); attack ...

CVE-2026-55045

CVE-2026-55045 is an Office remote code execution vulnerability described as an out-of-bounds read in Microsoft Office that could enable a local attacker to execute code. Connected sources tie this CVE to Microsoft Office components (Word/PowerPoint/SharePoint) with local-exploit prerequisites an...

CVE-2015-0086

CVE-2015-0086 affects Microsoft Office/Word products including Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold/SP1, Word 2013 RT Gold/SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Serve...

CVE-2026-64900

CVE-2026-64900 affects Microsoft Office SharePoint and is described as an improper neutralization of input during web page generation (XSS) that enables an authorized attacker to perform spoofing over a network. Exploitation requires network access, low attack complexity, low privileges , and use...

CVE-2026-64897

CVE-2026-64897 describes an XSS vulnerability in Microsoft Office SharePoint Server due to improper neutralization of input during web page generation. An authorized attacker could spoof users over the network. Documents indicate the flaw and its impact as spoofing, with CVSSv3.1 base score 4.6 (...

CVE-2009-3830

CVE-2009-3830 affects Microsoft SharePoint Server 2007 Team Services (versions 12.0.0.4518 and 12.0.0.6219). The vulnerability arises in the download functionality (_layouts/download.aspx) where pathnames supplied via SourceUrl/Source allow disclosure of ASP.NET source code. Impact is information...

CVE-2013-3858

CVE-2013-3858 affects Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer. The vulnerability allows remote attackers to execute arbitrary code or cause a ...

CVE-2026-33113

CVE-2026-33113 describes an issue in Microsoft Office SharePoint where improper neutralization of input during web page generation enables an authorized attacker to perform spoofing over a network. Affected component: SharePoint Server. Root cause: cross-site scripting due to inadequate input han...

CVE-2026-62917

CVE-2026-62917 concerns Microsoft SharePoint (Office SharePoint) with an improper input validation flaw. The vulnerability allows an authorized attacker to perform spoofing over a network. Documents identify the affected product as SharePoint Server and describe the root cause as input validation...

CVE-2011-1890

CVE-2011-1890 describes a Cross-Site Scripting (XSS) vulnerability in EditForm.aspx of Microsoft SharePoint Server 2010 and SharePoint Foundation 2010. The vulnerability allows a remote attacker to inject arbitrary web script or HTML via a POST, enabling XSS in affected SharePoint pages. Connecte...

CVE-2026-55038

CVE-2026-55038 is a stack-based buffer overflow in Microsoft Word (Office) that can allow local code execution. The vulnerability affects Word and is exploitable by a crafted file opened by a user with no privileges required, though user interaction is needed (per CVSS: LOCAL, UI: REQUIRED, Privi...

CVE-2013-0085

CVE-2013-0085 describes a buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 that can be triggered by a crafted URL, leading to a denial of service via a W3WP process crash and site outage. Affected products are SharePoint Server 2010 SP1 and SharePoint Fou...

CVE-2025-59235

CVE-2025-59235 is an information-disclosure vulnerability in Microsoft Excel (Office) caused by an out-of-bounds read. Public sources in the connected docs consistently identify the affected component as Excel within the Microsoft Office suite and link the issue to Excel information-disclosure mi...

CVE-2026-20958

CVE-2026-20958 is a Microsoft SharePoint SSRF information-disclosure vulnerability. Affected product: Microsoft Office SharePoint (on-premises SharePoint Server/Subscription Edition). Description in sources: SSRF in SharePoint could permit an authorized attacker to disclose information over a net...

CVE-2026-45484

This CVE involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to elevate privileges over a network. Affected component: SharePoint (deserialization vulnerability cited in multiple sources). Root cause: improper handling of deserialized input l...

CVE-2026-55052

CVE-2026-55052 concerns a privilege-elevation flaw in Microsoft SharePoint (Office SharePoint). The description across sources is a missing authorization vulnerability that could let an authorized attacker elevate privileges over a network. Affected components/versions are centered on Microsoft O...

CVE-2026-58639

CVE-2026-58639 describes a server-side request forgery (SSRF) in Microsoft Office SharePoint. The NVD entries indicate an authorized attacker can leverage SSRF to spoof over a network with a base CVSS v3.1 score of 6.5 (Medium): attack vector NETWORK, user interaction NONE, privileges required LO...