SH
Collaboration
SharePoint
On CISA KEVExploited in the wildRansomware-linked
632
CVEs
20
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 16High 316Medium 168Low 0
Watch
Add SharePoint to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-24072 | 8.8 | Feb 25 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2021-24066 | 8.8 | Feb 25 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2021-1707 | 8.8 | Jan 12 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2020-17121 | 8.8 | Dec 10 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2020-17061 | 8.8 | Nov 11 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2020-1583 | 8.8 | Aug 17 | An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory Affected: 2010; 2019 |
| CVE-2020-1495 | 8.8 | Aug 17 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory Affected: 2010 |
| CVE-2020-1448 | 8.8 | Jul 14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution… Affected: 2019 |
| CVE-2020-1447 | 8.8 | Jul 14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution… Affected: 2010; 2019 |
| CVE-2020-1446 | 8.8 | Jul 14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution… Affected: 2010; 2019 |
| CVE-2020-1439 | 8.8 | Jul 14 | A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source markup of XML file input, aka… Affected: 2010; 2019 |
| CVE-2020-1295 | 8.8 | Jun 9 | An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability' Affected: 2019 |
| CVE-2020-1181 | 8.8 | Jun 9 | A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint… Affected: 2019 |
| CVE-2020-1178 | 8.8 | Jun 9 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint… Affected: 2010; 2019 |
| CVE-2020-1102 | 8.8 | May 21 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2019 |
| CVE-2020-1069 | 8.8 | May 21 | A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls Affected: 2019 |
| CVE-2020-1024 | 8.8 | May 21 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2019 |
| CVE-2020-1023 | 8.8 | May 21 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2019 |
| CVE-2020-0974 | 8.8 | Apr 15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2019 |
| CVE-2020-0971 | 8.8 | Apr 15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2019 |
| CVE-2020-0932 | 8.8 | Apr 15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2019 |
| CVE-2020-0931 | 8.8 | Apr 15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2019 |
| CVE-2020-0929 | 8.8 | Apr 15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2019 |
| CVE-2020-0920 | 8.8 | Apr 15 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2019 |
| CVE-2020-0850 | 8.8 | Mar 12 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution… Affected: 2019 |
| CVE-2019-1296 | 8.8 | Sep 11 | A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution… Affected: 2019 |
| CVE-2019-1295 | 8.8 | Sep 11 | A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution… Affected: 2019 |
| CVE-2019-1261 | 8.8 | Sep 11 | A spoofing vulnerability exists in Microsoft SharePoint when it improperly handles requests to authorize applications, resulting in cross-site request forgery (CSRF).To exploit… Affected: 2019 |
| CVE-2019-1257 | 8.8 | Sep 11 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2019 |
| CVE-2019-0958 | 8.8 | May 16 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka… Affected: 2019 |
| CVE-2019-0957 | 8.8 | May 16 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka… Affected: 2019 |
| CVE-2019-0594 | 8.8 | Mar 5 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote… Affected: 2010; 2019 |
| CVE-2019-0585 | 8.8 | Jan 8 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Execution… Affected: 2013; 2016; 2019 |
| CVE-2018-8635 | 8.8 | Dec 12 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint… Affected: 2010 |
| CVE-2018-8504 | 8.8 | Oct 10 | A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View, aka "Microsoft Word Remote Code… Affected: 2010 |
| CVE-2018-0792 | 8.8 | Jan 10 | Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution… Affected: 2016 |
| CVE-2018-0789 | 8.8 | Jan 10 | Microsoft SharePoint Foundation 2010, Microsoft SharePoint Server 2013 and Microsoft SharePoint Server 2016 allow an elevation of privilege vulnerability due to the way web… Affected: 2010 |
| CVE-2017-8569 | 8.8 | Jul 11 | Microsoft SharePoint Server allows an elevation of privilege vulnerability due to the way that it sanitizes a specially crafted web request to an affected SharePoint server, aka… Affected: 2016 |
| CVE-2017-8509 | 8.8 | Jun 15 | A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability" Affected: 2010; 2013; 2016 |
| CVE-2016-0183 | 8.8 | May 11 | The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allows remote attackers… Affected: 2010 |
| CVE-2013-0006 | 8.8 | Jan 9 | Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka… Affected: 2007; 2007 |
| CVE-2026-70355 | 8.7 | Aug 11 | Microsoft SharePoint Server Elevation of Privilege Vulnerability Affected: before 16.0.19725.20522; 2019 |
| CVE-2026-55034 | 8.7 | Jul 14 | Microsoft SharePoint Server Spoofing Vulnerability Affected: before 16.0.19725.20434; 2016; 2019 |
| CVE-2026-55021 | 8.7 | Jul 14 | Microsoft SharePoint Server Spoofing Vulnerability Affected: before 16.0.19725.20434; 2016; 2019 |
| CVE-2020-16946 | 8.7 | Oct 16 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2019 |
| CVE-2020-16945 | 8.7 | Oct 16 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2019 |
| CVE-2020-16944 | 8.7 | Oct 16 | <p>This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.</p> <p>An authenticated attacker… Affected: 2019 |
| CVE-2020-16952 | 8.6 | Oct 16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2019 |
| CVE-2020-16951 | 8.6 | Oct 16 | <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package Affected: 2019 |
| CVE-2020-1460 | 8.6 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls Affected: 2019 |
The 500 most important CVEs for this product (exploited first, then by severity)