Microsoft

Records18046All Threatist records

Exploited (KEV)406In CISA KEV

CVSS critical2330CVSS 9.0–10.0

CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2026-73128 Microsoft Windows Command Injection Vulnerability CRITICAL 97KEV 2026-10-13 TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability CRITICAL 97KEV 2026-09-25 TI-2026-56567 Microsoft Windows Link Following Vulnerability CRITICAL 93KEV 2026-09-08 TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability CRITICAL 93KEV 2026-09-08 TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records

Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

226 records in Sharepoint Foundation · all components

TI-2019-00394 CVE-2019-0604 · GHSA-6mr5-xh3f-7vqm

Improper input validation in Microsoft SharePoint Server

CRITICAL 100KEV

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99913 Published 2019-03-06 No fix listed CWE-20

TI-2023-08100 CVE-2023-21716 · GHSA-64mm-8wcm-jw5g

Microsoft Word Remote Code Execution Vulnerability

CRITICAL 90

Microsoft Word Remote Code Execution Vulnerability

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.848 Published 2023-02-14 Fixed in https://aka.ms/OfficeSecurityReleases, 16.70.23021201 +4 CWE-190

TI-2022-21993 CVE-2022-44690 · GHSA-3c43-92jm-wfg6

Microsoft SharePoint Server Remote Code Execution Vulnerability

HIGH 79

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.82081 Published 2022-12-13 Fixed in 16.0.5373.1000, 15.0.5511.1000 +2

TI-2022-17767 CVE-2022-38053 · GHSA-58rh-q4r8-94g3

Microsoft SharePoint Server Remote Code Execution Vulnerability

HIGH 77

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.76397 Published 2022-10-11 Fixed in 16.0.5365.1000, 15.0.5493.1000 +2

TI-2020-12940 CVE-2020-16952 · GHSA-4xg2-wcmm-2j45

Microsoft SharePoint Remote Code Execution Vulnerability

HIGH 75

<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.71095 Published 2020-10-16 Fixed in publication CWE-346

TI-2020-01145 CVE-2020-1181 · GHSA-7q25-89mc-hp7w

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails…

HIGH 75

A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.69303 Published 2020-06-09 No fix listed

TI-2023-08124 CVE-2023-21742 · GHSA-rmqv-47pf-3wr7

Microsoft SharePoint Server Remote Code Execution Vulnerability

HIGH 73

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.55786 Published 2023-01-10 Fixed in 16.0.5378.1000, 15.0.5519.1000 +2 CWE-284

TI-2021-11401 CVE-2021-31181 · GHSA-jv6v-h246-28v4

Microsoft SharePoint Remote Code Execution Vulnerability

HIGH 73

Microsoft SharePoint Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.29011 Published 2021-05-11 Fixed in 16.0.5161.1000, 16.0.10374.20000 +1 CWE-94

TI-2022-16264 CVE-2022-35823 · GHSA-hh49-75rp-25qf

Microsoft SharePoint Remote Code Execution Vulnerability

HIGH 71

Microsoft SharePoint Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.54667 Published 2022-09-13 Fixed in 16.0.5361.1002, 15.0.5485.1000 +2

TI-2021-17534 CVE-2021-40487 · GHSA-w9qh-f4fr-cg94

Microsoft SharePoint Server Remote Code Execution Vulnerability

HIGH 71

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.48205 Published 2021-10-13 Fixed in 16.0.5227.1000, 16.0.10379.20000 +1 CWE-94

TI-2022-17680 CVE-2022-37961 · GHSA-mr4f-r439-x4qp

Microsoft SharePoint Server Remote Code Execution Vulnerability

HIGH 70

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.51817 Published 2022-09-13 Fixed in 16.0.5361.1002, 15.0.5485.1000 +2

TI-2021-09586 CVE-2021-28474 · GHSA-f4c7-7cmx-q7fx

Microsoft SharePoint Server Remote Code Execution Vulnerability

HIGH 69

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.50768 Published 2021-05-11 Fixed in 16.0.5161.1000, 16.0.10374.20000 +1 CWE-436

TI-2016-02824 CVE-2016-3357 · GHSA-3jv4-wff7-5wvx

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office…

HIGH 69

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, SharePoint Server 2…

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.54809 Published 2016-09-14 No fix listed CWE-119

TI-2013-01166 CVE-2013-1330 · GHSA-hcc7-7rjj-r32g

The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint…

HIGH 66

The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attac…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.30202 Published 2013-09-11 No fix listed CWE-20

TI-2018-05989 CVE-2018-8284 · GHSA-c5vc-j56m-8jj4

Code injection in Microsoft .NET Framework

HIGH 65

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET Framework 2.0, Micros…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.45991 Published 2018-07-11 No fix listed CWE-94

TI-2020-00902 CVE-2020-0932 · GHSA-f3pr-7rjp-hqhv

Unrestricted file upload in Microsoft SharePoint Enterprise Server

MEDIUM 64

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.35535 Published 2020-04-15 No fix listed CWE-434

TI-2013-01152 CVE-2013-1315 · GHSA-4hhx-gmqj-x5qp

Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010…

MEDIUM 63

Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.28867 Published 2013-09-11 No fix listed CWE-119

TI-2013-00035 CVE-2013-0081 · GHSA-3xgv-2qr4-qv6r

Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and…

MEDIUM 62

Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service (W3WP proces…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.76333 Published 2013-09-11 No fix listed CWE-20

TI-2020-01073 CVE-2020-1106 · GHSA-gvpw-6vh9-p999

Microsoft Office SharePoint XSS Vulnerability

MEDIUM 60

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04017 Published 2020-05-21 Fixed in publication CWE-79

TI-2015-00077 CVE-2015-0085 · GHSA-p6v9-v6m6-gqv6

Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint…

MEDIUM 60

Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.18745 Published 2015-03-11 No fix listed

TI-2015-01506 CVE-2015-1682 · GHSA-h4r2-qqhp-vxq5

Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office…

MEDIUM 59

Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.20398 Published 2015-05-13 No fix listed CWE-119

TI-2013-03357 CVE-2013-3847 · GHSA-5q76-mqhx-jj3x

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1…

MEDIUM 59

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote at…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.20971 Published 2013-09-11 No fix listed CWE-119

TI-2013-00039 CVE-2013-0085 · GHSA-6rm6-8j5v-wqjm

Buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010…

MEDIUM 59

Buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to cause a denial of service (W3WP process crash and site outage) via a crafted URL, aka "Buffer Overflow…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.33975 Published 2013-03-13 No fix listed CWE-119

TI-2020-01399 CVE-2020-1439 · GHSA-7vrg-q6mv-3q9x

Deserialization of untrusted data in Microsoft SharePoint Enterprise Server

MEDIUM 57

A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka 'PerformancePoint Services Remote Code Execution V…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.20265 Published 2020-07-14 No fix listed CWE-502

TI-2021-08646 CVE-2021-27076 · GHSA-v4x2-cq4f-rv9r

Microsoft SharePoint Server Remote Code Execution Vulnerability

MEDIUM 56

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.15168 Published 2021-03-11 Fixed in 14.0.7267.5000, 16.0.5134.1000 +2

Open these records in search →

Critical	2330
High	10410
Medium	5035
Low	270
No CVSS	1