Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,171

Export CSV
CVE-2026-40418

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 3 more
CVE-2026-40367

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 10 more
CVE-2026-40362

Microsoft Excel Remote Code Execution Vulnerability

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Excel Excel 2016 and 8 more
CVE-2026-40358

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2016 and 6 more
CVE-2026-40421

Microsoft Word Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 5 more
CVE-2026-40366

Microsoft Word Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps Office Office 2019 and 7 more
CVE-2020-16918

Base3D Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists when the Base3D rendering engine improperly handles memory.</p> <p>An attacker who successfully exploited the vulnerability would gain execution on a victim system.</p> <p>The security update addresses the vulnerability by correcting how the Base3D rendering engine handles memory.</p>

CVSS 3.1 · 7.8 High EPSS 3.9% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 3d Viewer
CVE-2026-41090

Microsoft Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot 365 Copilot Ios 365 Copilot Ios
CVE-2026-42827

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-40363

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 365 Copilot Office and 8 more
CVE-2026-26134

Microsoft Office Elevation of Privilege Vulnerability

Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Office
CVE-2026-26110

Microsoft Office Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 365 Copilot Office and 7 more
CVE-2026-25180

Windows Graphics Component Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Office Office For Android and 30 more
CVE-2025-47167

Microsoft Office Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 365 Copilot Office and 7 more
CVE-2025-62557

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 365 Copilot Office and 7 more
CVE-2025-62554

Microsoft Office Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 365 Copilot Office and 7 more
CVE-2025-53766

GDI+ Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 11.5% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Gdi+ Gdiplus and 27 more
CVE-2025-53732

Microsoft Office Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Office