Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-65665 | 8.8 high | 2.0% | microsoft, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-65663 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-65658 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-63514 | 8.8 high | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-33110 | 8.8 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-35439 | 8.8 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-40357 | 8.8 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-70321 | 8.8 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Sat 24 Oct |
| CVE-2026-66805 | 8.8 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 21 Oct |
| CVE-2025-59237 | 8.8 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 18 Oct |
| CVE-2026-85900 | 8.8 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 14 Oct |
| CVE-2026-40368 | 8.0 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2025-62204 | 8.0 high | 2.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 18 Oct |
| CVE-2026-63516 | 6.5 medium | 2.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2026-88178 | 9.8 critical | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-88156 | 9.8 critical | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-70291 | 9.8 critical | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-97016 | 9.8 critical | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-97749 | 9.8 critical | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 15 Oct |
| CVE-2026-70300 | 9.8 critical | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 14 Oct |
| CVE-2026-70332 | 9.6 critical | 1.0% | microsoft, sharepoint_online | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | Sat 24 Oct |
| CVE-2026-70306 | 9.3 critical | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 13 h ago |
| CVE-2026-54733 | 9.3 critical | 1.0% | no CPE yet | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1. | Sat 24 Oct |
| CVE-2025-64672 | 9.0 critical | 1.0% | microsoft, sharepoint_server | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 14 Oct |
| CVE-2026-64921 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-62870 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-70329 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft office 2019, microsoft office ltsc 2021 | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-70324 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-58277 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-65807 | 8.8 high | 1.0% | microsoft, microsoft 365 apps for enterprise, microsoft excel 2016, microsoft office 2019 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | 13 h ago |
| CVE-2026-55052 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-62827 | 8.8 high | 1.0% | microsoft, microsoft sharepoint enterprise server 2016, microsoft sharepoint server 2019, microsoft sharepoint server subscription edition | Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 13 h ago |
| CVE-2026-40365 | 8.8 high | 1.0% | microsoft, sharepoint_server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-70326 | 8.8 high | 1.0% | microsoft, sharepoint_server | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Sat 24 Oct |
| CVE-2026-69943 | 8.8 high | 1.0% | microsoft, sharepoint_server | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-88164 | 8.8 high | 1.0% | microsoft, sharepoint_server | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 20 Oct |
| CVE-2026-102855 | 8.8 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108426 | 8.8 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108427 | 8.8 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108428 | 8.8 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108429 | 8.8 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108430 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108431 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108432 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108437 | 8.8 high | 1.0% | microsoft, 365_apps, office_2021, office_2024 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108439 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108440 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108441 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108442 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 20 Oct |
| CVE-2026-108443 | 8.8 high | 1.0% | microsoft, 365_apps, microsoft_365, office_2021 | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 19 Oct |
Download these 582 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.