Microsoft Sharepoint Server vulnerabilities

CVE-2026-108452 [HIGH] CWE-22 CVE-2026-108452: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-102860 [HIGH] CWE-284 CVE-2026-102860: Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate priv Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-102862 [HIGH] CWE-863 CVE-2026-102862: Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate priv Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-88198 [HIGH] CWE-862 CVE-2026-88198: Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privil Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2019-1257 [HIGH] CWE-20 CVE-2019-1257: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1295, CVE-2019-1296.

CVE-2020-0929 [HIGH] CVE-2020-0929: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0931, CVE-2020-0932, CVE-2020-0971, CVE-2020-0974.

CVE-2020-0931 [HIGH] CVE-2020-0931: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0932, CVE-2020-0971, CVE-2020-0974.

CVE-2020-0974 [HIGH] CVE-2020-0974: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920, CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0971.

CVE-2020-0920 [HIGH] CWE-434 CVE-2020-0920: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0929, CVE-2020-0931, CVE-2020-0932, CVE-2020-0971, CVE-2020-0974.

CVE-2023-33160 [HIGH] CWE-502 CVE-2023-33160: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2014-0260 [CRITICAL] CWE-119 CVE-2014-0260: Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office docum

CVE-2017-8509 [HIGH] CVE-2017-8509: A remote code execution vulnerability exists in Microsoft Office when the software fails to properly A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, CVE-2017-0260, and CVE-2017-8506.

CVE-2019-0594 [HIGH] CWE-20 CVE-2019-0594: A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to chec A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0604.

CVE-2021-34520 [HIGH] CWE-502 CVE-2021-34520: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2013-3857 [CRITICAL] CWE-119 CVE-2013-3857: Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and Microsoft Word Automation Services in SharePoint Server 2010 SP1 and SP2, Word Web App 2010 SP1 and SP2 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1 and SP2, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office docu

CVE-2020-17061 [HIGH] CVE-2020-17061: Microsoft SharePoint Remote Code Execution Vulnerability Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2022-30158 [HIGH] CVE-2022-30158: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2022-41038 [HIGH] CVE-2022-41038: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2023-21744 [HIGH] CWE-502 CVE-2023-21744: Microsoft SharePoint Server Remote Code Execution Vulnerability Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2025-59237 [HIGH] CWE-502 CVE-2025-59237: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.