Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-55018 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55024 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55017 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-50467 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-50314 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-50301 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-47642 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-47290 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-58618 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55948 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-55899 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-50675 | 7.8 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | Wed 28 Oct |
| CVE-2026-68800 | 7.8 high | 0.00% | microsoft, 365_apps, excel, microsoft_365 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 Oct |
| CVE-2026-68798 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 21 Oct |
| CVE-2026-108433 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | 20 Oct |
| CVE-2026-97001 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 15 Oct |
| CVE-2026-96997 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Use after free in Microsoft Office OneNote allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-96995 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. | 15 Oct |
| CVE-2026-88210 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | 15 Oct |
| CVE-2026-70220 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 15 Oct |
| CVE-2026-50387 | 7.8 high | 0.00% | microsoft, 365_copilot, microsoft_365, office_2021 | Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally. | 14 Oct |
| CVE-2026-63533 | 7.8 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2016 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 14 Oct |
| CVE-2026-108448 | 7.5 high | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 19 Oct |
| CVE-2026-69477 | 7.3 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft access 2016, microsoft access 2016 (32-bit edition) | Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally. | 19 h ago |
| CVE-2026-107759 | 7.2 high | — | wpo365, wpo365 | microsoft 365 graph mailer | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation. | 10 h ago |
| CVE-2026-56193 | 7.1 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-81389 | 7.0 high | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2016 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 19 h ago |
| CVE-2026-106078 | 6.9 medium | 0.00% | no CPE yet | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service. | Wed 28 Oct |
| CVE-2026-50678 | 6.6 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-55026 | 6.2 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-55898 | 6.1 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-54988 | 6.1 medium | 0.00% | microsoft, 365_apps, excel, microsoft_365 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 14 Oct |
| CVE-2026-66809 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | 24 h ago |
| CVE-2026-66810 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 24 h ago |
| CVE-2026-66806 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 24 h ago |
| CVE-2026-70322 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70323 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70320 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70319 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70325 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70317 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70315 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70316 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-70312 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office 365 for mac | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-68809 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-63521 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | Fri 30 Oct |
| CVE-2026-55139 | 5.5 medium | 0.00% | microsoft, microsoft 365 apps for enterprise, microsoft office 2016, microsoft office 2019 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. | Wed 28 Oct |
| CVE-2026-70310 | 5.5 medium | 0.00% | microsoft, 365_apps, microsoft_365, office_2019 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 24 Oct |
| CVE-2026-97744 | 5.5 medium | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | 15 Oct |
| CVE-2026-97005 | 5.5 medium | 0.00% | microsoft, 365_apps, microsoft_365, office_2021 | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | 15 Oct |
Download these 401 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.