Sharepoint Server (Microsoft) - vulnerabilities (CVEs)

637 CVEs, 38 in the last 30 days, 64 known versions, newest CVE from 2026-10-15. Vendor: Microsoft.

CVEs of Sharepoint Server

• CVE-2026-108452 - CVSS 8.8 (high), 2026-10-15: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code…
• CVE-2026-88164 - CVSS 8.8 (high), 2026-10-14: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-105013 - CVSS 7.4 (high), 2026-10-13: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-96044 - CVSS 8.8 (high), 2026-10-13: No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-88206 - CVSS 7.5 (high), 2026-10-13: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-88166 - CVSS 8.8 (high), 2026-10-13: Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-88200 - CVSS 8.8 (high), 2026-10-13: Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-85932 - CVSS 6.5 (medium), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose…
• CVE-2026-70246 - CVSS 8.8 (high), 2026-10-13: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-88163 - CVSS 8.8 (high), 2026-10-13: Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-70217 - CVSS 4.9 (medium), 2026-10-13: Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-70202 - CVSS 7.5 (high), 2026-10-13: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-97755 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
• CVE-2026-97783 - CVSS 8.1 (high), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform…
• CVE-2026-97782 - CVSS 6.8 (medium), 2026-10-13: Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
• CVE-2026-88208 - CVSS 4.6 (medium), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-88198 - CVSS 8.8 (high), 2026-10-13: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-88204 - CVSS 7.3 (high), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-88209 - CVSS 4.6 (medium), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-70298 - CVSS 6.5 (medium), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose…
• CVE-2026-88155 - CVSS 8.8 (high), 2026-10-13: Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-85900 - CVSS 8.8 (high), 2026-10-13: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-70259 - CVSS 6.5 (medium), 2026-10-13: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-70251 - CVSS 7.5 (high), 2026-10-13: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-70267 - CVSS 7.2 (high), 2026-10-13: Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-70266 - CVSS 8.8 (high), 2026-10-13: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate…
• CVE-2026-69943 - CVSS 8.8 (high), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code…
• CVE-2026-105719 - CVSS 6.5 (medium), 2026-10-13: Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-105713 - CVSS 5.7 (medium), 2026-10-13: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
• CVE-2026-105720 - CVSS 4.3 (medium), 2026-10-13: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-102863 - CVSS 8.8 (high), 2026-10-13: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-102866 - CVSS 8.1 (high), 2026-10-13: Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-102862 - CVSS 8.8 (high), 2026-10-13: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-102865 - CVSS 6.5 (medium), 2026-10-13: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-102864 - CVSS 4.6 (medium), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-102860 - CVSS 8.8 (high), 2026-10-13: Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-102859 - CVSS 4.6 (medium), 2026-10-13: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-102861 - CVSS 8.8 (high), 2026-10-13: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69465 - CVSS 8.8 (high), 2026-09-08: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-69904 - CVSS 3.5 (low), 2026-09-08: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-69636 - CVSS 6.5 (medium), 2026-09-08: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose…
• CVE-2026-69464 - CVSS 8.8 (high), 2026-09-08: Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69615 - CVSS 4.8 (medium), 2026-09-08: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-69417 - CVSS 7.3 (high), 2026-09-08: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-69409 - CVSS 6.5 (medium), 2026-09-08: Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-69402 - CVSS 7.3 (high), 2026-09-08: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-69282 - CVSS 8.8 (high), 2026-09-08: Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-69273 - CVSS 8.8 (high), 2026-09-08: Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-69268 - CVSS 8.8 (high), 2026-09-08: Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-69804 - CVSS 7.5 (high), 2026-09-08: Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-69683 - CVSS 7.7 (high), 2026-09-08: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-69690 - CVSS 5.4 (medium), 2026-09-08: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-69724 - CVSS 8.8 (high), 2026-09-08: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-69716 - CVSS 8.8 (high), 2026-09-08: Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate…
• CVE-2026-62917 - CVSS 4.6 (medium), 2026-08-11: Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
• CVE-2026-58639 - CVSS 6.5 (medium), 2026-08-11: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
• CVE-2026-62839 - CVSS 6.5 (medium), 2026-08-11: Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
• CVE-2026-70326 - CVSS 8.8 (high), 2026-08-11: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-70306 - CVSS 9.3 (critical), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform…
• CVE-2026-66808 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-66805 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-64921 - CVSS 8.8 (high), 2026-08-11: Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-64916 - CVSS 5.4 (medium), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-64901 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-64902 - CVSS 5.4 (medium), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-64900 - CVSS 7.3 (high), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-64897 - CVSS 5.4 (medium), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-70355 - CVSS 8.7 (high), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate…
• CVE-2026-70324 - CVSS 8.8 (high), 2026-08-11: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-70321 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-65665 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-65663 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-65660 - CVSS 8.8 (high), 2026-08-11: Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-65658 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-64922 - CVSS 5.4 (medium), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-63520 - CVSS 8.1 (high), 2026-08-11: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
• CVE-2026-63512 - CVSS 6.5 (medium), 2026-08-11: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
• CVE-2026-63516 - CVSS 6.5 (medium), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
• CVE-2026-62837 - CVSS 6.5 (medium), 2026-08-11: Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-63514 - CVSS 8.8 (high), 2026-08-11: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
• CVE-2026-62827 - CVSS 8.8 (high), 2026-08-11: Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-62829 - CVSS 5.4 (medium), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-57105 - CVSS 8 (high), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-62826 - CVSS 5.4 (medium), 2026-07-16: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-55121 - CVSS 5.5 (medium), 2026-07-14: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-58277 - CVSS 8.8 (high), 2026-07-14: Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-56192 - CVSS 5.5 (medium), 2026-07-14: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
• CVE-2026-56157 - CVSS 5.4 (medium), 2026-07-14: Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
• CVE-2026-55135 - CVSS 5.4 (medium), 2026-07-14: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-55052 - CVSS 8.8 (high), 2026-07-14: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
• CVE-2026-55130 - CVSS 7.8 (high), 2026-07-14: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-55128 - CVSS 7.8 (high), 2026-07-14: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-55142 - CVSS 5.5 (medium), 2026-07-14: Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-55040 - CVSS 9.1 (critical), 2026-07-14: Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-55134 - CVSS 7.8 (high), 2026-07-14: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-55051 - CVSS 6.5 (medium), 2026-07-14: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
• CVE-2026-55126 - CVSS 7.3 (high), 2026-07-14: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform…
• CVE-2026-55132 - CVSS 7.8 (high), 2026-07-14: Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-55038 - CVSS 7.8 (high), 2026-07-14: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
• CVE-2026-55055 - CVSS 7.8 (high), 2026-07-14: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.