Microsoft Sharepoint Server Subscription Edition vulnerabilities
189 known vulnerabilities affecting microsoft/microsoft_sharepoint_server_subscription_edition.
Total CVEs
189
CISA KEV
10
actively exploited
Public exploits
10
Exploited in wild
16
Severity breakdown
CRITICAL9HIGH109MEDIUM67LOW4
Vulnerabilities
Page 9 of 10
CVE-2026-47636P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47636 [MEDIUM] CWE-79 CVE-2026-47636: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-47639P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47639 [MEDIUM] CWE-79 CVE-2026-47639: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45453P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45453 [MEDIUM] CWE-79 CVE-2026-45453: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45464P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45464 [MEDIUM] CWE-79 CVE-2026-45464: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45465P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45465 [MEDIUM] CWE-79 CVE-2026-45465: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-47637P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47637 [MEDIUM] CWE-79 CVE-2026-47637: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-47638P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47638 [MEDIUM] CWE-79 CVE-2026-47638: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-45468P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45468 [MEDIUM] CWE-79 CVE-2026-45468: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-47640P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-47640 [MEDIUM] CWE-79 CVE-2026-47640: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-45462P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45462 [MEDIUM] CWE-79 CVE-2026-45462: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-45479P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45479 [MEDIUM] CWE-79 CVE-2026-45479: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-45467P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45467 [MEDIUM] CWE-79 CVE-2026-45467: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-45483P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-45483 [MEDIUM] CWE-79 CVE-2026-45483: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55020P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55020 [MEDIUM] CWE-79 CVE-2026-55020: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55016P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55016 [MEDIUM] CWE-79 CVE-2026-55016: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55135P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-14
CVE-2026-55135 [MEDIUM] CWE-79 CVE-2026-55135: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-62826P4MEDIUMCVSS 5.4≥ 16.0.0, < 16.0.19725.204342026-07-16
CVE-2026-62826 [MEDIUM] CWE-79 CVE-2026-62826: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-44821P4MEDIUMCVSS 5.5≥ 16.0.0, < 16.0.19725.203842026-06-09
CVE-2026-44821 [MEDIUM] CWE-125 CVE-2026-44821: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information local
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
nvd
CVE-2022-21968P4MEDIUMCVSS 4.3≥ 16.0.0, < 16.0.14326.207422022-02-09
CVE-2022-21968 [MEDIUM] CVE-2022-21968: Microsoft SharePoint Server Security Feature Bypass Vulnerability
Microsoft SharePoint Server Security Feature Bypass Vulnerability
nvd
CVE-2022-30159P4MEDIUMCVSS 5.5≥ 16.0.0, < 16.0.14931.204182022-06-15
CVE-2022-30159 [MEDIUM] CVE-2022-30159: Microsoft Office Information Disclosure Vulnerability
Microsoft Office Information Disclosure Vulnerability
nvd