Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

24 records in Project Server · all components

TI-2018-05989 CVE-2018-8284 · GHSA-c5vc-j56m-8jj4

Code injection in Microsoft .NET Framework

Priority HIGH 65

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET Framework 2.0, Micros…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.45991 Published 2018-07-11 No fix listed CWE-94
TI-2009-00094 CVE-2009-0102 · GHSA-4m9h-cpwq-g6hj

Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly…

Priority MEDIUM 60

Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a malformed file, aka "Proje…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.23504 Published 2009-12-09 No fix listed CWE-399
TI-2015-02200 CVE-2015-2503 · GHSA-v53c-88vh-q6gw

Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3…

Priority MEDIUM 57

Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, E…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.1653 Published 2015-11-11 No fix listed CWE-264
TI-2014-00243 CVE-2014-0251 · GHSA-hcw7-j5pr-h3vx

Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and…

Priority MEDIUM 54

Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 Gold and SP1; SharePoint Foundation 2010 SP1 and SP2 and 2013 Gold and SP1; Project Server 2010 SP1 and SP2 and 2013 G…

CVSS 2.0HIGH 9.0 Network Low privileges Interaction — EPSS 0.14214 Published 2014-05-14 No fix listed CWE-94
TI-2006-06361 CVE-2006-6617 · GHSA-vprv-694j-g4mw

projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote…

Priority MEDIUM 48

projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the inform…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.20366 Published 2006-12-18 No fix listed
TI-2018-00877 CVE-2018-0944 · GHSA-jv9f-492h-3rf8

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevatio…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00852 CVE-2018-0916 · GHSA-v2fr-qc6r-hgg3

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00851 CVE-2018-0915 · GHSA-wpxh-93fh-jc87

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00850 CVE-2018-0914 · GHSA-ffg4-wgfj-8xw5

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00849 CVE-2018-0913 · GHSA-mgj8-8wcp-4jw2

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00848 CVE-2018-0912 · GHSA-jmmm-7mh8-g38q

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00847 CVE-2018-0911 · GHSA-6vqp-xcc2-m4hf

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00846 CVE-2018-0910 · GHSA-j5jw-xrqm-q6mg

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2018-00845 CVE-2018-0909 · GHSA-x3rx-wjvf-34g8

Cross-site scripting in Microsoft SharePoint

Priority MEDIUM 45

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.04528 Published 2018-03-14 No fix listed CWE-79
TI-2017-08815 CVE-2017-11876 · GHSA-hc3g-h2rv-xpmc

Cross-site request forgery in Microsoft Server

Priority MEDIUM 43

Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the…

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02474 Published 2017-11-15 No fix listed CWE-352
TI-2017-06084 CVE-2017-8551 · GHSA-8cr9-r7p7-cphf

Cross-site scripting in Microsoft SharePoint

Priority LOW 33

An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.03263 Published 2017-06-15 No fix listed CWE-79
TI-2018-05970 CVE-2018-8254 · GHSA-wq96-r46v-f46v

Cross-site scripting in Microsoft Project Server

Priority LOW 30

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privileg…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02999 Published 2018-06-14 No fix listed CWE-79
TI-2018-05901 CVE-2018-8156 · GHSA-p8cv-3fj6-f5hw

Cross-site scripting in Microsoft SharePoint

Priority LOW 30

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privileg…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02801 Published 2018-05-09 No fix listed CWE-79
TI-2020-00924 CVE-2020-0954 · GHSA-h4rw-8g46-q3rm

Cross-site scripting in Microsoft SharePoint Enterprise Server

Priority LOW 28

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnera…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01515 Published 2020-04-15 No fix listed CWE-79
TI-2019-00770 CVE-2019-1036 · GHSA-h9p5-99c5-626c

Microsoft Office SharePoint XSS Vulnerability

Priority LOW 28

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01662 Published 2019-06-12 Fixed in publication CWE-79
TI-2019-00767 CVE-2019-1033 · GHSA-gp38-6cc3-gxr4

Microsoft Office SharePoint XSS Vulnerability

Priority LOW 28

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01662 Published 2019-06-12 Fixed in publication CWE-79
TI-2019-00765 CVE-2019-1031 · GHSA-8gxq-78pr-9qcw

Microsoft Office SharePoint XSS Vulnerability

Priority LOW 28

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01662 Published 2019-06-12 Fixed in publication CWE-79
Open these records in search →