ON
Product
OneNote
On CISA KEVExploited in the wild
16
CVEs
1
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 8Medium 4Low 0
Watch
Add OneNote to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2007-0671 In wildKEV | 8.8 | Feb 3 | Microsoft Office Excel Remote Code Execution Vulnerability Affected: 2003 |
| CVE-2017-8509 | 8.8 | Jun 15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: 2010 |
| CVE-2014-2815 | 8.8 | Aug 12 | Microsoft OneNote 2007 SP3 allows remote attackers to execute arbitrary code via a crafted OneNote file that triggers creation of an executable file in a startup folder, aka… Affected: 2007 |
| CVE-2025-29822 | 7.8 | Apr 8 | Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally Affected: 2016 |
| CVE-2025-21402 | 7.8 | Jan 14 | Microsoft Office OneNote Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2017-0197 | 7.8 | Apr 12 | Microsoft OneNote 2007 SP3 and Microsoft OneNote 2010 SP2 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office DLL Loading Vulnerability." Affected: 2007; 2010 |
| CVE-2026-26133 | 7.1 | Mar 16 | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network Affected: before 16.0.19725.20142 |
| CVE-2024-41159 | 7.1 | Dec 18 | A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS Affected: 16.83 for macOS |
| CVE-2023-33140 | 6.5 | Jun 14 | Microsoft OneNote Spoofing Vulnerability Affected: All versions, or not specified |
| CVE-2023-21721 | 6.5 | Feb 14 | Microsoft OneNote Elevation of Privilege Vulnerability Affected: before 16.0.16026.20158 |
| CVE-2016-3315 | 5.5 | Aug 9 | Microsoft OneNote 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNote file, aka… Affected: 2007; 2010; 2013; 2013; 2016 |
| CVE-2023-36769 | 5.4 | Nov 6 | Microsoft OneNote Spoofing Vulnerability Affected: 2013; 2013; 2016; 2019; 2021 |
| CVE-2015-2503 | – | Nov 11 | Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office… Affected: 2007; 2010; 2013; 2013; 2016 |
| CVE-2008-3068 | – | Jul 7 | Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary… Affected: 2003 |
| CVE-2006-3877 | – | Oct 10 | Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute… Affected: 2003 |
| CVE-2004-0200 | – | Sep 28 | Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code… Affected: 2003 |
Showing 16