Fixes 31 records
Priority CRITICAL 100KEV
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.15873 · Published 2026-07-14 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-502
Priority HIGH 65
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.33544 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-502
Priority MEDIUM 43
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0163 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-22
Priority LOW 39
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.00438 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.110.26061317 +4 CWE-416
Priority LOW 39
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.00438 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.110.26061317 +4 CWE-843
Priority LOW 38
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00615 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-285
Priority LOW 36
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00455 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5556.1005 +3 CWE-122
Priority LOW 36
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00455 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.110.26061317 +4 CWE-822
Priority LOW 36
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00455 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5556.1005 +3 CWE-122
Priority LOW 36
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00455 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5556.1005 +3 CWE-122
Priority LOW 35
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00514 · Published 2026-06-09 · Fixed in 16.0.10417.20153, 16.0.19725.20384 CWE-74
Priority LOW 35
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00632 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 28
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0048 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 26
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00862 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-502
Priority LOW 25
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-20
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00469 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00469 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00469 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00469 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00469 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 25
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00465 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5556.1005 +3 CWE-125
Priority LOW 22
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00464 · Published 2026-06-09 · Fixed in 16.0.5556.1005, 16.0.10417.20153 +1 CWE-79
Priority LOW 16
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVSS 3.1LOW 3.3· Local · No auth · User interaction · EPSS 0.00437 · Published 2026-06-09 · Fixed in https://aka.ms/OfficeSecurityReleases, 16.0.5556.1005 +3 CWE-125
THREATIST.IORead the docs