Microsoft Sharepoint Server vulnerabilities

CVE-2026-55127 [HIGH] CWE-122 CVE-2026-55127: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-55055 [HIGH] CWE-121 CVE-2026-55055: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-55128 [HIGH] CWE-416 CVE-2026-55128: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-55130 [HIGH] CWE-122 CVE-2026-55130: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-55032 [HIGH] CWE-416 CVE-2026-55032: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-55134 [HIGH] CWE-121 CVE-2026-55134: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2020-0852 [HIGH] CVE-2020-0852: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly ha A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0855, CVE-2020-0892.

CVE-2020-0892 [HIGH] CVE-2020-0892: A remote code execution vulnerability exists in Microsoft Word software when it fails to properly ha A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0852, CVE-2020-0855.

CVE-2020-17016 [HIGH] CVE-2020-17016: Microsoft SharePoint Server Spoofing Vulnerability Microsoft SharePoint Server Spoofing Vulnerability

CVE-2026-55034 [HIGH] CWE-79 CVE-2026-55034: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2021-31966 [HIGH] CVE-2021-31966: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2024-49068 [HIGH] CWE-284 CVE-2024-49068: Microsoft SharePoint Elevation of Privilege Vulnerability Microsoft SharePoint Elevation of Privilege Vulnerability

CVE-2013-3895 [MEDIUM] CWE-264 CVE-2013-3895: Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickja Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, aka "Parameter Injection Vulnerability."

CVE-2026-20951 [HIGH] CWE-20 CVE-2026-20951: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.

CVE-2026-55132 [HIGH] CWE-415 CVE-2026-55132: Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2025-59222 [HIGH] CWE-416 CVE-2025-59222: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2016-3279 [MEDIUM] CWE-254 CVE-2016-3279: Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, Power Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Excel 2016, Word 2016, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via

CVE-2025-64672 [CRITICAL] CWE-79 CVE-2025-64672: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-55021 [HIGH] CWE-79 CVE-2026-55021: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2024-49070 [HIGH] CWE-502 CVE-2024-49070: Microsoft SharePoint Remote Code Execution Vulnerability Microsoft SharePoint Remote Code Execution Vulnerability