Microsoft Office SharePoint vulnerabilities
139 known CVE vulnerabilities in Microsoft Office SharePoint, translated and rated.
- CVE-2026-20951High
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- CVE-2026-20947High
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70306Critical
A cross-site scripting vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-65660HighActively exploited
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70332Critical
Improper input neutralization during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-55040CriticalActively exploited
A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.
- CVE-2026-58644CriticalActively exploited
A deserialization of untrusted data vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to execute code remotely over a network.
- CVE-2026-56164MediumActively exploited
Missing authentication for a critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-50522CriticalActively exploited
Deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An unauthenticated attacker can remotely execute code on the SharePoint server.
- CVE-2026-33112High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-32201MediumActively exploited
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-20945Medium
Improper neutralization of input during web page generation (cross-site scripting) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- CVE-2025-54897High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. The vulnerability arises from unsafe processing of serialized objects.
- CVE-2025-49706MediumActively exploited
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2025-49704HighActively exploited
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-108452High
A path traversal vulnerability in Microsoft Office SharePoint is caused by improper limitation of a pathname to a restricted directory. An authorized attacker can execute code over a network.
- CVE-2026-88164High
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-97783High
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-97782Medium
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. The attacker can modify data in a way detectable as an inconsistency.
- CVE-2026-96044High
A vulnerability with no assigned CWE in Microsoft Office SharePoint allows an authenticated attacker to elevate privileges over a network. The flaw enables privilege escalation within the SharePoint environment.
- CVE-2026-88209Medium
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint results from improper neutralization of input during web page generation. An authorized attacker can perform spoofing over a network.
- CVE-2026-88208Medium
A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint results from improper neutralization of input during web page generation. An authorized attacker can perform spoofing over a network.
- CVE-2026-88206High
Server-side request forgery (SSRF) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-88204High
Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint due to improper input neutralization during web page generation. Allows an authorized attacker to perform spoofing over a network.
- CVE-2026-88200High
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. The issue involves improper security context management.
- CVE-2026-88198High
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. The issue stems from improper access permission verification.
- CVE-2026-88166High
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-88163High
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-88155High
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-85932Medium
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. The vulnerability enables access to files outside the intended directory.
- CVE-2026-85900High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70298Medium
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- CVE-2026-70267High
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-70266High
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-70259Medium
Server-side request forgery (SSRF) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- CVE-2026-70251High
A server-side request forgery (SSRF) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-70246High
An incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-70217Medium
Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- CVE-2026-70202High
A server-side request forgery (SSRF) vulnerability in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69943High
Improper limitation of a pathname to a restricted directory (path traversal) in Microsoft Office SharePoint. An authorized attacker can execute code over a network.
- CVE-2026-105720Medium
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. The flaw enables bypassing access control mechanisms.
- CVE-2026-105719Medium
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. The flaw stems from insufficient verification of input data.
- CVE-2026-105713Medium
Server-side request forgery (SSRF) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network. The flaw enables making requests to internal resources.
- CVE-2026-105013High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- CVE-2026-102866High
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-102865Medium
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. An attacker may access data they should not be permitted to see.
- CVE-2026-102864Medium
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. An attacker may inject a malicious script into a page.
- CVE-2026-102863High
Improper control of code generation (code injection) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-102862High
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-102861High
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS