CVE-2026-48562

Summary: CVE-2026-48562 affects Microsoft Office SharePoint Server. It describes improper neutralization of input during web page generation, causing cross-site scripting that could enable an authorized attacker to perform spoofing over a network. The associated metrics assign a CVSS v3.1 base sc...

CVE-2026-21511

CVE-2026-21511 describes deserialization of untrusted data in Microsoft Office Outlook, enabling an unauthorized attacker to spoof over a network. Affected product: Microsoft Office Outlook. Root cause: unsafe deserialization of data. Impact: spoofing with network access; CVSS v3.1 base score 7.5...

CVE-2008-5026

CVE-2008-5026 involves Microsoft SharePoint, where the Documents module allows uploading files using the same hostname/port as the site’s primary files. This enables remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) by uploading HTML documents...

CVE-2025-53760

CVE-2025-53760 is a Microsoft SharePoint elevation-of-privilege vulnerability described as an SSRF issue that can allow an authorized attacker to gain elevated privileges over a network. The CVSS v3.1 score is 7.1 (HIGH) with Network attack vector, low attack complexity, and privileges required: ...

CVE-2025-54897

CVE-2025-54897 is a Microsoft SharePoint remote code execution vulnerability caused by deserialization of untrusted data, enabling an authorized attacker to execute code over the network. The CVSSv3.1 base score is 8.8 ( HIGH ), with network access, low attack complexity, and low privileges requi...

CVE-2026-63514

Summary: CVE-2026-63514 involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to execute code remotely over a network. Affected component: SharePoint Server (deserialization path in untrusted data handling). Impact: Remote code execution with H...

CVE-2026-70321

CVE-2026-70321: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Affected software is Microsoft SharePoint; root cause is deserialization of untrusted data. Impact is high (CVE-2026-70321 CVSS 3.1: 8.8/10). No remediati...

CVE-2026-64916

CVE-2026-64916 affects Microsoft Office SharePoint Server and relates to improper neutralization of input during web page generation (XSS), enabling an authorized attacker to spoof over a network. The CVSS 3.1 base score is 4.6 (Medium) with Network access, Low attack complexity, Low privileges r...

CVE-2026-62827

CVE-2026-62827 is a Microsoft SharePoint vulnerability describing improper authentication that allows an authorized attacker to elevate privileges over a network. Documents indicate the affected product is Microsoft Office SharePoint/SharePoint Server. The issue is a privilege-escalation flaw wit...

CVE-2026-70355

CVE-2026-70355 affects Microsoft Office SharePoint/SharePoint Server; improper neutralization of input during web page generation (XSS) could allow an authorized attacker to elevate privileges over the network. The CVSSv3.1 base score is 7.3 (HIGH) with NETWORK attack vector, LOW attack complexit...

CVE-2026-33113

CVE-2026-33113 describes an issue in Microsoft Office SharePoint where improper neutralization of input during web page generation enables an authorized attacker to perform spoofing over a network. Affected component: SharePoint Server. Root cause: cross-site scripting due to inadequate input han...

CVE-2026-55132

Microsoft Word/Office vulnerability CVE-2026-55132 involves a double-free in Word that could allow a local attacker to execute arbitrary code. Affected product: Microsoft Word (Office suite). Root cause: memory management flaw (double free) in Word’s handling of certain documents. Impact: local c...

CVE-2026-26113

CVE-2026-26113 is a Microsoft Office remote code-execution vulnerability caused by an untrusted pointer dereference. The issue is addressed in the March 2026 Patch Tuesday updates for Office; affected products are patched by Microsoft through the updates referenced by the vulnerability entry. The...

CVE-2026-45468

CVE-2026-45468 involves an improper neutralization of input during web page generation (XSS) in Microsoft Office SharePoint / SharePoint Server . An authorized attacker can perform spoofing over a network by targeting affected SharePoint web pages. The CVSS 3.1 base score is 4.6 (Medium); attack ...

CVE-2026-55032

CVE-2026-55032 is a Microsoft Word remote code execution vulnerability reported as a use-after-free issue in Microsoft Office Word. The CVE entry specifies local attack vector with user interaction required, yielding a high severity (CVSS 3.1: 7.8, HIGH) and potential for arbitrary code execution...

CVE-2026-45485

CVE-2026-45485: In Microsoft Office, an out-of-bounds read leads to local information disclosure. Documents confirm the vulnerability and its impact (local disclosure) with low severity (CVSS 3.1:3.3). Exploitation details and affected component/version specifics are not provided in the supplied ...

CVE-2026-65658

CVE-2026-65658 involves a deserialization vulnerability in Microsoft Office SharePoint that can allow an authorized attacker to execute arbitrary code over the network. The published description identifies deserialization of untrusted data as the root cause, with the CVSS 3.1 base score of 8.8 (H...

CVE-2026-45484

This CVE involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to elevate privileges over a network. Affected component: SharePoint (deserialization vulnerability cited in multiple sources). Root cause: improper handling of deserialized input l...

CVE-2026-55121

CVE-2026-55121 corresponds to an out-of-bounds read in Microsoft Office that enables an unauthenticated or authorized local attacker to disclose information. The public descriptions across NVD/MSRC and EUVD notes indicate the vulnerability affects Microsoft Office components and results in local ...

CVE-2025-59237

CVE-2025-59237 is a SharePoint remote code execution vulnerability described as deserialization of untrusted data allowing an authenticated attacker to run code over the network. The advisory includes a CVSS v3.1 base score of 8.8 (HIGH) with network access, low attack complexity, and privileges ...

CVE-2026-56192

The CVE-2026-56192 entry describes a local, information-disclosure vulnerability in Microsoft Office caused by an out-of-bounds read. Affected product: Microsoft Office suite (Office components) per multiple connected sources. Root cause and exact vulnerable component are not fully detailed in th...

CVE-2026-20958

CVE-2026-20958 is a Microsoft SharePoint SSRF information-disclosure vulnerability. Affected product: Microsoft Office SharePoint (on-premises SharePoint Server/Subscription Edition). Description in sources: SSRF in SharePoint could permit an authorized attacker to disclose information over a net...

CVE-2026-70324

CVE-2026-70324 describes a server-side request forgery (SSRF) in Microsoft Office SharePoint that allows an authorized attacker to elevate privileges over a network. Affected product: SharePoint server components; root cause is SSRF enabling privilege escalation. The CVSSv3.1 score is 8.8 (HIGH) ...

CVE-2025-49701

CVE-2025-49701 is a Microsoft SharePoint remote code execution vulnerability caused by improper authorization, enabling an authenticated attacker to execute code over the network. Public advisories confirm impact as remote code execution in SharePoint environments, with patched updates released i...

CVE-2026-45471

CVE-2026-45471 affects Microsoft Word and stems from an untrusted pointer dereference in Word’s runtime that can lead to local code execution. The CVSSv3.1 vector (L/Low complexity, no privileges required, user interaction required, local scope) yields a base score of 7.8 (HIGH). Documented impac...

CVE-2026-55135

CVE-2026-55135 concerns a cross-site scripting spoofing vulnerability in Microsoft Office SharePoint. The connected sources identify the affected product as Microsoft SharePoint Server (part of Office/SharePoint), and describe the root cause as improper neutralization of input during web page gen...

CVE-2025-59228

CVE-2025-59228 corresponds to a Microsoft SharePoint remote code execution vulnerability caused by improper input validation. Affected component is SharePoint within Office ecosystem; exploitation allows an authorized attacker to execute arbitrary code over a network with low privileges and no us...

CVE-2026-44824

CVE-2026-44824 affects Microsoft Office and is a heap-based buffer overflow that enables local code execution. The issue requires user interaction and has a CVSS v3.1 base score of 7.8 (HIGH) with LOCAL attack vector, no privileges required, and high impact on confidentiality, integrity, and avai...

CVE-2026-64900

CVE-2026-64900 affects Microsoft Office SharePoint and is described as an improper neutralization of input during web page generation (XSS) that enables an authorized attacker to perform spoofing over a network. Exploitation requires network access, low attack complexity, low privileges , and use...

CVE-2026-64901

CVE-2026-64901 involves deserialization of untrusted data in Microsoft Office SharePoint, enabling an authorized attacker to execute code over the network. The vulnerability affects Microsoft SharePoint Server components as described in the CVE entries; the underlying issue is untrusted-deseriali...

CVE-2026-55127

CVE-2026-55127 is a heap-based buffer overflow in Microsoft Word (Office) that enables local code execution. Public sources corroborate a Word-related RCE risk, with the issue categorized under Office/Word vulnerabilities in July 2026 patch disclosures. Remediation is via Microsoft’s July 2026 se...

CVE-2026-62917

CVE-2026-62917 concerns Microsoft SharePoint (Office SharePoint) with an improper input validation flaw. The vulnerability allows an authorized attacker to perform spoofing over a network. Documents identify the affected product as SharePoint Server and describe the root cause as input validation...

CVE-2026-26106

CVE-2026-26106 is a Microsoft SharePoint Server remote code execution vulnerability caused by improper input validation. The CVE affects SharePoint Server variants (Office/SharePoint components) and enables an authenticated (network) attacker with low privileges to execute arbitrary code, potenti...

CVE-2026-40368

CVE-2026-40368 is a remote code execution vulnerability in Microsoft SharePoint Server caused by deserialization of untrusted data. The issue affects SharePoint Server on-premises (various versions) and can be triggered by processing crafted data over the network by an authenticated user, with CV...

CVE-2026-47298

CVE-2026-47298 constrains Microsoft Office SharePoint, where improper authorization allows an attacker with network access to execute code on vulnerable systems. The vulnerability is described as a remote code execution issue with a high impact on confidentiality, integrity, and availability (CVE...

CVE-2026-55045

CVE-2026-55045 is an Office remote code execution vulnerability described as an out-of-bounds read in Microsoft Office that could enable a local attacker to execute code. Connected sources tie this CVE to Microsoft Office components (Word/PowerPoint/SharePoint) with local-exploit prerequisites an...

CVE-2026-55052

CVE-2026-55052 concerns a privilege-elevation flaw in Microsoft SharePoint (Office SharePoint). The description across sources is a missing authorization vulnerability that could let an authorized attacker elevate privileges over a network. Affected components/versions are centered on Microsoft O...

CVE-2026-58639

CVE-2026-58639 describes a server-side request forgery (SSRF) in Microsoft Office SharePoint. The NVD entries indicate an authorized attacker can leverage SSRF to spoof over a network with a base CVSS v3.1 score of 6.5 (Medium): attack vector NETWORK, user interaction NONE, privileges required LO...

CVE-2026-26105

CVE-2026-26105 : A cross-site scripting vulnerability in Microsoft SharePoint (Office SharePoint) arises from improper input neutralization during web page generation, enabling an attacker to spoof over a network. Connected sources corroborate spoofing/impersonation risk for SharePoint Server. Im...

CVE-2026-55128

CVE-2026-55128 is a Use-after-free in Microsoft Word that enables local code execution by an unauthenticated attacker who powers the exploit via a crafted file/link. Affected product scope is Microsoft Word/Office as per Microsoft advisories; document does not specify exact vulnerable builds or p...

CVE-2026-55038

CVE-2026-55038 is a stack-based buffer overflow in Microsoft Word (Office) that can allow local code execution. The vulnerability affects Word and is exploitable by a crafted file opened by a user with no privileges required, though user interaction is needed (per CVSS: LOCAL, UI: REQUIRED, Privi...

CVE-2026-62837

CVE-2026-62837 is a relative path traversal flaw in Microsoft Office SharePoint Server that can disclose information over the network. Affected component: SharePoint Server; root cause: improper handling of path traversal in requests; impact: confidentiality exposure (CVE metrics show CVSSv3.1 ba...

CVE-2026-64897

CVE-2026-64897 describes an XSS vulnerability in Microsoft Office SharePoint Server due to improper neutralization of input during web page generation. An authorized attacker could spoof users over the network. Documents indicate the flaw and its impact as spoofing, with CVSSv3.1 base score 4.6 (...

CVE-2026-44821

The CVE-2026-44821 entry concerns an out-of-bounds read in Microsoft Office that could allow a local attacker to disclose information. Affected software is Microsoft Office; the vulnerability is a read boundary issue in a component/file used by Office, enabling local information disclosure. The p...

CVE-2026-55020

CVE-2026-55020 is an Office SharePoint cross-site scripting vulnerability described as improper neutralization of input during web page generation, enabling an authenticated attacker to spoof over the network. The affected component is Microsoft Office SharePoint; root cause is input handling in ...

CVE-2026-63516

Deserialization of untrusted data in Microsoft Office SharePoint is the root cause of CVE-2026-63516, leading to spoofing over a network by an authorized attacker. Affected component: SharePoint Server (Microsoft Office SharePoint). CVE notes that exploitation is possible through network access w...

CVE-2026-45467

CVE-2026-45467 describes an XSS vulnerability in Microsoft Office SharePoint Server caused by improper neutralization of input during web page generation. The issue can allow a network-based, authenticated attacker with low privileges to spoof content presented to users, requiring user interactio...

CVE-2026-55142

Microsoft Word within Office is affected by CVE-2026-55142 due to a numeric truncation error that can disclose information locally. Exploitation is local with required user interaction; the advisory notes a security update from Microsoft as remediation. References to July 2026 Office advisories c...

CVE-2026-65663

CVE-2026-65663 affects Microsoft SharePoint Server and is caused by deserialization of untrusted data, enabling an authorized attacker to execute code remotely over a network. The NVD entry and CVE records describe a remote code execution vulnerability with high impact (C:H, I:H, A:H) and network...

CVE-2026-20951

CVE-2026-20951 is a Microsoft SharePoint Server Remote Code Execution vulnerability caused by improper input validation in SharePoint. The issue allows an unauthenticated or authenticated attacker to execute code locally on affected SharePoint Server deployments. Documented affected products incl...