SH
Collaboration
SharePoint
On CISA KEVExploited in the wildRansomware-linked
632
CVEs
20
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 16High 316Medium 168Low 0
Watch
Add SharePoint to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45454 | 8.8 | Jun 9 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: before 16.0.19725.20384; 2016; 2019 |
| CVE-2026-40365 | 8.8 | May 12 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.19725.20280; 2016; 2019 |
| CVE-2026-40357 | 8.8 | May 12 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.19725.20280; 2016; 2019 |
| CVE-2026-33112 | 8.8 | May 12 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.19725.20280; 2016; 2019 |
| CVE-2026-33110 | 8.8 | May 12 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.19725.20280; 2016; 2019 |
| CVE-2026-35439 | 8.8 | May 12 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.19725.20280; 2016; 2019 |
| CVE-2026-26106 | 8.8 | Mar 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.19725.20076; 2016; 2019 |
| CVE-2026-26114 | 8.8 | Mar 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2026-20947 | 8.8 | Jan 13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.19127.20442; 2016; 2019 |
| CVE-2025-59237 | 8.8 | Oct 14 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.19127.20262; 2016; 2019 |
| CVE-2025-59228 | 8.8 | Oct 14 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.19127.20262; 2016; 2019 |
| CVE-2025-54897 | 8.8 | Sep 9 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.19127.20100; 2016; 2019 |
| CVE-2025-49712 | 8.8 | Aug 12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: 2016; 2019 |
| CVE-2025-49701 | 8.8 | Jul 8 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.18526.20424; 2016; 2019 |
| CVE-2025-47172 | 8.8 | Jun 10 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: through 16.0.18526.20396; 2019 |
| CVE-2025-47166 | 8.8 | Jun 10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.18526.20396; 2019 |
| CVE-2025-47163 | 8.8 | Jun 10 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.18526.20396; 2019 |
| CVE-2025-29794 | 8.8 | Apr 8 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.18526.20172; 2019 |
| CVE-2024-38018 | 8.8 | Sep 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2024-21318 | 8.8 | Jan 9 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2023-36764 | 8.8 | Sep 12 | Microsoft SharePoint Server Elevation of Privilege Vulnerability Affected: 2016; 2019 |
| CVE-2023-33160 | 8.8 | Jul 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2023-33159 | 8.8 | Jul 11 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016; 2019 |
| CVE-2023-33157 | 8.8 | Jul 11 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2023-33134 | 8.8 | Jul 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2023-21717 | 8.8 | Feb 14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability Affected: 2019 |
| CVE-2023-21744 | 8.8 | Jan 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2023-21742 | 8.8 | Jan 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-44693 | 8.8 | Dec 13 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-44690 | 8.8 | Dec 13 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-41062 | 8.8 | Nov 9 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-41036 | 8.8 | Oct 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-38053 | 8.8 | Oct 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-41038 | 8.8 | Oct 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-41037 | 8.8 | Oct 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-38009 | 8.8 | Sep 13 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-38008 | 8.8 | Sep 13 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-37961 | 8.8 | Sep 13 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-35823 | 8.8 | Sep 13 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-30158 | 8.8 | Jun 15 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-30157 | 8.8 | Jun 15 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-29108 | 8.8 | May 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-22005 | 8.8 | Feb 9 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2022-21840 | 8.8 | Jan 11 | Microsoft Office Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2022-21837 | 8.8 | Jan 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2021-43876 | 8.8 | Dec 29 | Microsoft SharePoint Elevation of Privilege Vulnerability Affected: 2019 |
| CVE-2021-42309 | 8.8 | Dec 15 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2021-31181 | 8.8 | May 11 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2021-28474 | 8.8 | May 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2021-27076 | 8.8 | Mar 11 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
The 500 most important CVEs for this product (exploited first, then by severity)