Microsoft Sharepoint Server Subscription Edition vulnerabilities
272 known vulnerabilities affecting microsoft/microsoft_sharepoint_server_subscription_edition.
Total CVEs
272
CISA KEV
12
actively exploited
Public exploits
14
Exploited in wild
19
Severity breakdown
CRITICAL10HIGH157MEDIUM100LOW5
Vulnerabilities
Page 12 of 14
CVE-2026-64900P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.205222026-08-11
CVE-2026-64900 [MEDIUM] CWE-79 CVE-2026-64900: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55126P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55126 [MEDIUM] CWE-79 CVE-2026-55126: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-57105P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.205222026-08-11
CVE-2026-57105 [MEDIUM] CWE-79 CVE-2026-57105: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64922P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.205222026-08-11
CVE-2026-64922 [MEDIUM] CWE-79 CVE-2026-64922: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64916P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.205222026-08-11
CVE-2026-64916 [MEDIUM] CWE-79 CVE-2026-64916: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64897P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.205222026-08-11
CVE-2026-64897 [MEDIUM] CWE-79 CVE-2026-64897: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64902P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.205222026-08-11
CVE-2026-64902 [MEDIUM] CWE-79 CVE-2026-64902: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-62826P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-16
CVE-2026-62826 [MEDIUM] CWE-79 CVE-2026-62826: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55019P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55019 [MEDIUM] CWE-79 CVE-2026-55019: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55020P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55020 [MEDIUM] CWE-79 CVE-2026-55020: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55016P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55016 [MEDIUM] CWE-79 CVE-2026-55016: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55135P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55135 [MEDIUM] CWE-79 CVE-2026-55135: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55030P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55030 [MEDIUM] CWE-79 CVE-2026-55030: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-47636P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47636 [MEDIUM] CWE-79 CVE-2026-47636: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-47639P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47639 [MEDIUM] CWE-79 CVE-2026-47639: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45453P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45453 [MEDIUM] CWE-79 CVE-2026-45453: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45464P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45464 [MEDIUM] CWE-79 CVE-2026-45464: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45465P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45465 [MEDIUM] CWE-79 CVE-2026-45465: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-47637P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47637 [MEDIUM] CWE-79 CVE-2026-47637: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-47638P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47638 [MEDIUM] CWE-79 CVE-2026-47638: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd