Microsoft Sharepoint Server vulnerabilities
630 known vulnerabilities affecting microsoft/sharepoint_server.
Total CVEs
630
CISA KEV
20
actively exploited
Public exploits
33
Exploited in wild
34
Severity breakdown
CRITICAL45HIGH311MEDIUM258LOW16
Vulnerabilities
Page 26 of 32
CVE-2026-55047P4MEDIUMCVSS 5.5fixed in 16.0.19725.20434v16.0.19725.20434+2 more2026-07-14
CVE-2026-55047 [MEDIUM] CWE-125 CVE-2026-55047: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information local
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
nvd
CVE-2026-55023P4MEDIUMCVSS 5.5fixed in 16.0.19725.20434v2016+1 more2026-07-14
CVE-2026-55023 [MEDIUM] CWE-125 CVE-2026-55023: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information local
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
nvd
CVE-2026-45481P4MEDIUMCVSS 5.4fixed in 16.0.19725.20384v2016+1 more2026-06-09
CVE-2026-45481 [MEDIUM] CWE-79 CVE-2026-45481: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64900P4MEDIUMCVSS 5.4fixed in 16.0.19725.20522v2016+1 more2026-08-11
CVE-2026-64900 [MEDIUM] CWE-79 CVE-2026-64900: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55126P4MEDIUMCVSS 5.4fixed in 16.0.19725.20434v2016+1 more2026-07-14
CVE-2026-55126 [MEDIUM] CWE-79 CVE-2026-55126: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-57105P4MEDIUMCVSS 5.4fixed in 16.0.19725.20522v20192026-08-11
CVE-2026-57105 [MEDIUM] CWE-79 CVE-2026-57105: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64922P4MEDIUMCVSS 5.4fixed in 16.0.19725.20522v2016+1 more2026-08-11
CVE-2026-64922 [MEDIUM] CWE-79 CVE-2026-64922: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64916P4MEDIUMCVSS 5.4fixed in 16.0.19725.20522v2016+1 more2026-08-11
CVE-2026-64916 [MEDIUM] CWE-79 CVE-2026-64916: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64897P4MEDIUMCVSS 5.4fixed in 16.0.19725.20522v2016+1 more2026-08-11
CVE-2026-64897 [MEDIUM] CWE-79 CVE-2026-64897: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-64902P4MEDIUMCVSS 5.4fixed in 16.0.19725.20522v2016+1 more2026-08-11
CVE-2026-64902 [MEDIUM] CWE-79 CVE-2026-64902: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-62826P4MEDIUMCVSS 5.4fixed in 16.0.19725.20434v2016+1 more2026-07-16
CVE-2026-62826 [MEDIUM] CWE-79 CVE-2026-62826: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55019P4MEDIUMCVSS 5.4fixed in 16.0.19725.20434v2016+1 more2026-07-14
CVE-2026-55019 [MEDIUM] CWE-79 CVE-2026-55019: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55020P4MEDIUMCVSS 5.4fixed in 16.0.19725.20434v2016+1 more2026-07-14
CVE-2026-55020 [MEDIUM] CWE-79 CVE-2026-55020: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55016P4MEDIUMCVSS 5.4fixed in 16.0.19725.20434v2016+1 more2026-07-14
CVE-2026-55016 [MEDIUM] CWE-79 CVE-2026-55016: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55135P4MEDIUMCVSS 5.4fixed in 16.0.19725.20434v2016+1 more2026-07-14
CVE-2026-55135 [MEDIUM] CWE-79 CVE-2026-55135: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-55030P4MEDIUMCVSS 5.4fixed in 16.0.19725.20434v2016+1 more2026-07-14
CVE-2026-55030 [MEDIUM] CWE-79 CVE-2026-55030: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2026-47636P4MEDIUMCVSS 5.4fixed in 16.0.19725.20384v2016+1 more2026-06-09
CVE-2026-47636 [MEDIUM] CWE-79 CVE-2026-47636: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-47639P4MEDIUMCVSS 5.4fixed in 16.0.19725.20384v2016+1 more2026-06-09
CVE-2026-47639 [MEDIUM] CWE-79 CVE-2026-47639: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45453P4MEDIUMCVSS 5.4fixed in 16.0.19725.20384v2016+1 more2026-06-09
CVE-2026-45453 [MEDIUM] CWE-79 CVE-2026-45453: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-45464P4MEDIUMCVSS 5.4fixed in 16.0.19725.20384v2016+1 more2026-06-09
CVE-2026-45464 [MEDIUM] CWE-79 CVE-2026-45464: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
nvd