SE
Product
Sharepoint Enterprise Server
On CISA KEVExploited in the wildRansomware-linked
256
CVEs
5
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 5High 128Medium 122Low 1
Watch
Add Sharepoint Enterprise Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-47168 | 7.8 | Jun 10 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2025-29820 | 7.8 | Apr 8 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2025-27747 | 7.8 | Apr 8 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally Affected: 2016 |
| CVE-2022-41061 | 7.8 | Nov 9 | Microsoft Word Remote Code Execution Vulnerability Affected: 2013; 2016 |
| CVE-2022-21842 | 7.8 | Jan 11 | Microsoft Word Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2021-40442 | 7.8 | Nov 10 | Microsoft Excel Remote Code Execution Vulnerability Affected: 2013 |
| CVE-2021-40486 | 7.8 | Oct 13 | Microsoft Word Remote Code Execution Vulnerability Affected: 2013; 2016 |
| CVE-2021-40485 | 7.8 | Oct 13 | Microsoft Excel Remote Code Execution Vulnerability Affected: 2013 |
| CVE-2021-1716 | 7.8 | Jan 12 | Microsoft Word Remote Code Execution Vulnerability Affected: 2013; 2016 |
| CVE-2021-1715 | 7.8 | Jan 12 | Microsoft Word Remote Code Execution Vulnerability Affected: 2013; 2016 |
| CVE-2021-1714 | 7.8 | Jan 12 | Microsoft Excel Remote Code Execution Vulnerability Affected: 2013 |
| CVE-2020-16929 | 7.8 | Oct 16 | <p>A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory Affected: 2013 |
| CVE-2020-1218 | 7.8 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory Affected: 2013; 2016 |
| CVE-2020-0980 | 7.8 | Apr 15 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution… Affected: 2013; 2016 |
| CVE-2020-0892 | 7.8 | Mar 12 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution… Affected: 2013; 2016 |
| CVE-2019-1201 | 7.8 | Aug 14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory Affected: 2013; 2016 |
| CVE-2019-1034 | 7.8 | Jun 12 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory Affected: 2013; 2016 |
| CVE-2018-8628 | 7.8 | Dec 12 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft PowerPoint Remote Code… Affected: 2016 |
| CVE-2018-0922 | 7.8 | Mar 14 | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Microsoft Office Web Apps… Affected: 2013; 2016 |
| CVE-2018-0797 | 7.8 | Jan 10 | Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF content is handled, aka "Microsoft Word… Affected: 2013; 2016 |
| CVE-2017-8742 | 7.8 | Sep 13 | A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3, Microsoft PowerPoint 2010 Service Pack 2, Microsoft PowerPoint 2013 Service Pack 1,… Affected: 2016 |
| CVE-2017-0003 | 7.8 | Jan 10 | Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption… Affected: 2016 |
| CVE-2021-40484 | 7.6 | Oct 13 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2021-38652 | 7.6 | Sep 15 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2021-38651 | 7.6 | Sep 15 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2021-36940 | 7.6 | Aug 12 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2013; 2016 |
| CVE-2021-31948 | 7.6 | Jun 8 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2019-1006 | 7.5 | Jul 15 | An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary… Affected: 2013; 2016 |
| CVE-2020-1345 | 7.4 | Sep 11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2016 |
| CVE-2020-1198 | 7.4 | Sep 11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2016 |
| CVE-2025-29793 | 7.2 | Apr 8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: 2016 |
| CVE-2021-42294 | 7.2 | Dec 15 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016 |
| CVE-2025-54905 | 7.1 | Sep 9 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally Affected: 2016 |
| CVE-2021-26420 | 7.1 | Jun 8 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2023-38177 | 6.8 | Nov 14 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2023-24954 | 6.5 | May 9 | Microsoft SharePoint Server Information Disclosure Vulnerability Affected: 2016 |
| CVE-2023-24950 | 6.5 | May 9 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016 |
| CVE-2022-41122 | 6.5 | Nov 9 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2013; 2016 |
| CVE-2020-16953 | 6.5 | Oct 16 | <p>An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory Affected: 2016 |
| CVE-2020-16948 | 6.5 | Oct 16 | <p>An information disclosure vulnerability exists when Microsoft SharePoint Server fails to properly handle objects in memory Affected: 2016 |
| CVE-2020-1103 | 6.5 | May 21 | An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks (a variant of… Affected: 2016 |
| CVE-2019-1443 | 6.5 | Nov 12 | An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who… Affected: 2016 |
| CVE-2019-1330 | 6.5 | Oct 10 | An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability' Affected: 2016; 2019 |
| CVE-2019-1260 | 6.5 | Sep 11 | An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability' Affected: 2016 |
| CVE-2019-0956 | 6.5 | May 16 | An information disclosure vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka… Affected: 2016 |
| CVE-2020-1482 | 6.3 | Sep 11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2016 |
| CVE-2020-1440 | 6.3 | Sep 11 | <p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data Affected: 2013; 2016 |
| CVE-2025-53736 | 6.2 | Aug 12 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally Affected: 2016 |
| CVE-2020-1323 | 6.1 | Jun 9 | An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing.To exploit the vulnerability, an attacker could send a link that has a specially crafted… Affected: 2016 |
| CVE-2020-1106 | 6.1 | May 21 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2016 |
