Microsoft Sharepoint Server vulnerabilities

CVE-2026-69804 [HIGH] CWE-367 CVE-2026-69804: Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint allows an authorize Time-of-check time-of-use (toctou) race condition in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-70267 [HIGH] CWE-829 CVE-2026-70267: Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an au Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2017-8501 [HIGH] CWE-119 CVE-2017-8501: Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8502.

CVE-2025-62204 [HIGH] CWE-502 CVE-2025-62204: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2024-38228 [HIGH] CWE-77 CVE-2024-38228: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2013-0080 [HIGH] CWE-264 CVE-2013-0080: Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to by Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."

CVE-2020-1295 [HIGH] CVE-2020-1295: An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint El An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.

CVE-2026-26105 [CRITICAL] CWE-79 CVE-2026-26105: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2023-21717 [HIGH] CWE-284 CVE-2023-21717: Microsoft SharePoint Server Elevation of Privilege Vulnerability Microsoft SharePoint Server Elevation of Privilege Vulnerability

CVE-2013-0081 [MEDIUM] CWE-20 CVE-2013-0081: Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 20 Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service (W3WP process hang) via a crafted URL, aka "SharePoint Denial of Service Vulnerability."

CVE-2026-40367 [HIGH] CWE-822 CVE-2026-40367: Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an una Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-45456 [HIGH] CWE-843 CVE-2026-45456: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthor Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-21260 [HIGH] CWE-200 CVE-2026-21260: Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an una Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-69683 [HIGH] CWE-918 CVE-2026-69683: Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to d Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

CVE-2026-55125 [HIGH] CWE-122 CVE-2026-55125: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code local Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-105013 [HIGH] CWE-502 CVE-2026-105013: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-70306 [CRITICAL] CWE-79 CVE-2026-70306: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2013-3895 [MEDIUM] CWE-264 CVE-2013-3895: Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickja Microsoft SharePoint Server 2007 SP3 and 2010 SP1 and SP2 allows remote attackers to conduct clickjacking attacks via a crafted web page, aka "Parameter Injection Vulnerability."

CVE-2024-49068 [HIGH] CWE-284 CVE-2024-49068: Microsoft SharePoint Elevation of Privilege Vulnerability Microsoft SharePoint Elevation of Privilege Vulnerability

CVE-2026-55128 [HIGH] CWE-416 CVE-2026-55128: Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.