CVE-2026-55134

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55038

Microsoft Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55032

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-55021

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-55033

Microsoft Word Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-56164

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 5.3 Medium EPSS 27.3% KEV · Listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-55030

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-55023

Microsoft Office Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2016 and 9 more

CVE-2026-54108

Microsoft SharePoint Server Spoofing Vulnerability

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-55052

Microsoft SharePoint Elevation of Privilege Vulnerability

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-58277

Microsoft SharePoint Elevation of Privilege Vulnerability

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-48560

Microsoft SharePoint Server Spoofing Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-45465

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-45464

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-33113

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-47641

Microsoft SharePoint Server Spoofing Vulnerability

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-47639

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more

CVE-2026-47636

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019

CVE-2026-45458

Microsoft Outlook and Word Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Office 2019 and 10 more

CVE-2026-45453

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Enterprise Server 2016 Sharepoint Server Sharepoint Server 2016 and 2 more