OO
Product
Office Online Server
On CISA KEVExploited in the wild
305
CVEs
1
On KEV
9.8
Max CVSS
44
New 30D
Severity mix
Critical 2High 249Medium 52Low 2
Watch
Add Office Online Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-97760 | 6.5 | Oct 13 | Microsoft Office Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20228 |
| CVE-2026-97779 | 6.5 | Oct 13 | Microsoft Office Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20228 |
| CVE-2026-97740 | 6.5 | Oct 13 | Microsoft Office Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20228 |
| CVE-2026-70328 | 6.5 | Aug 11 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-70327 | 6.5 | Aug 11 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-55054 | 6.5 | Jul 14 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2023-23396 | 6.5 | Mar 14 | Microsoft Excel Denial of Service Vulnerability Affected: All versions, or not specified |
| CVE-2026-54988 | 6.1 | Jul 14 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2020-1442 | 6.1 | Jul 14 | A spoofing vulnerability exists when an Office Web Apps server does not properly sanitize a specially crafted request, aka 'Office Web Apps XSS Vulnerability' Affected: All versions, or not specified |
| CVE-2026-81401 | 5.5 | Sep 8 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20207 |
| CVE-2026-81390 | 5.5 | Sep 8 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20207 |
| CVE-2026-68799 | 5.5 | Aug 11 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-68797 | 5.5 | Aug 11 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-68808 | 5.5 | Aug 11 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-68802 | 5.5 | Aug 11 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-55124 | 5.5 | Jul 14 | Microsoft Word Information Disclosure Vulnerability Affected: before 16.0.10417.20175 |
| CVE-2026-55138 | 5.5 | Jul 14 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-55050 | 5.5 | Jul 14 | Microsoft Word Information Disclosure Vulnerability Affected: before 16.0.10417.20175 |
| CVE-2026-55047 | 5.5 | Jul 14 | Microsoft Office Information Disclosure Vulnerability Affected: before 16.0.10417.20175 |
| CVE-2026-55046 | 5.5 | Jul 14 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-50408 | 5.5 | Jul 14 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-48580 | 5.5 | Jul 14 | Microsoft Excel Information Disclosure Vulnerability Affected: 16.0.0.0 before 16.0.10417.20175 |
| CVE-2026-21261 | 5.5 | Feb 10 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally Affected: before 16.0.10417.20097 |
| CVE-2026-21258 | 5.5 | Feb 10 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally Affected: before 16.0.10417.20097 |
| CVE-2025-48812 | 5.5 | Jul 8 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally Affected: before 16.0.10417.20027 |
| CVE-2023-36766 | 5.5 | Sep 12 | Microsoft Excel Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2023-33162 | 5.5 | Jul 11 | Microsoft Excel Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2022-41103 | 5.5 | Nov 9 | Microsoft Word Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2022-41060 | 5.5 | Nov 9 | Microsoft Word Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2022-30172 | 5.5 | Jun 15 | Microsoft Office Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2022-30171 | 5.5 | Jun 15 | Microsoft Office Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2022-30159 | 5.5 | Jun 15 | Microsoft Office Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2022-22716 | 5.5 | Feb 9 | Microsoft Excel Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2021-40472 | 5.5 | Oct 13 | Microsoft Excel Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2021-31178 | 5.5 | May 11 | Microsoft Office Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2021-31174 | 5.5 | May 11 | Microsoft Excel Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2021-28456 | 5.5 | Apr 13 | Microsoft Excel Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2020-17126 | 5.5 | Dec 10 | Microsoft Excel Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2020-1224 | 5.5 | Sep 11 | <p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory Affected: All versions, or not specified |
| CVE-2020-1503 | 5.5 | Aug 17 | An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory Affected: All versions, or not specified |
| CVE-2020-1502 | 5.5 | Aug 17 | An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory Affected: All versions, or not specified |
| CVE-2020-1445 | 5.5 | Jul 14 | An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka 'Microsoft Office Information Disclosure Vulnerability' Affected: All versions, or not specified |
| CVE-2020-1342 | 5.5 | Jul 14 | An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose the contents of… Affected: All versions, or not specified |
| CVE-2019-1446 | 5.5 | Nov 12 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability' Affected: All versions, or not specified |
| CVE-2020-0695 | 5.4 | Feb 11 | A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Server Spoofing… Affected: All versions, or not specified |
| CVE-2020-0647 | 5.4 | Jan 14 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Spoofing Vulnerability' Affected: All versions, or not specified |
| CVE-2019-1447 | 5.4 | Nov 12 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability' Affected: All versions, or not specified |
| CVE-2019-1445 | 5.4 | Nov 12 | A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability' Affected: All versions, or not specified |
| CVE-2018-8247 | 5.4 | Jun 14 | An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests, aka "Microsoft Office Elevation of… Affected: 2016 |
| CVE-2017-0195 | 5.4 | Apr 12 | Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server… Affected: All versions, or not specified |
