SH
Collaboration
SharePoint
On CISA KEVExploited in the wildRansomware-linked
632
CVEs
20
On KEV
9.9
Max CVSS
38
New 30D
Severity mix
Critical 16High 316Medium 168Low 0
Watch
Add SharePoint to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3281 | 7.8 | Jul 13 | Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation Services on SharePoint Server 2010 SP2,… Affected: 2010 |
| CVE-2016-0140 | 7.8 | May 11 | Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code… Affected: 2010 |
| CVE-2016-0127 | 7.8 | Apr 12 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server… Affected: 2010; 2013 |
| CVE-2016-0134 | 7.8 | Mar 9 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word… Affected: 2010; 2013 |
| CVE-2016-0054 | 7.8 | Feb 10 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel… Affected: 2013 |
| CVE-2016-0053 | 7.8 | Feb 10 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on… Affected: 2013 |
| CVE-2016-0052 | 7.8 | Feb 10 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word… Affected: 2013 |
| CVE-2016-0022 | 7.8 | Feb 10 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word… Affected: 2013 |
| CVE-2026-69683 | 7.7 | Sep 8 | Microsoft Office SharePoint Information Disclosure Vulnerability Affected: before 16.0.20326.20082 |
| CVE-2021-40484 | 7.6 | Oct 13 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2019 |
| CVE-2021-40483 | 7.6 | Oct 13 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2019 |
| CVE-2021-38651 | 7.6 | Sep 15 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2019 |
| CVE-2021-36940 | 7.6 | Aug 12 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2019 |
| CVE-2021-31964 | 7.6 | Jun 8 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016; 2019 |
| CVE-2021-31950 | 7.6 | Jun 8 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016; 2019 |
| CVE-2021-31948 | 7.6 | Jun 8 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2019 |
| CVE-2021-28478 | 7.6 | May 11 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2016; 2019 |
| CVE-2026-88206 | 7.5 | Oct 13 | Microsoft Office SharePoint Elevation of Privilege Vulnerability Affected: before 16.0.20326.20190 |
| CVE-2026-70202 | 7.5 | Oct 13 | Microsoft Office SharePoint Elevation of Privilege Vulnerability Affected: before 16.0.20326.20190 |
| CVE-2026-70251 | 7.5 | Oct 13 | Microsoft Office SharePoint Elevation of Privilege Vulnerability Affected: before 16.0.20326.20190 |
| CVE-2026-69804 | 7.5 | Sep 8 | Microsoft Office SharePoint Remote Code Execution Vulnerability Affected: before 16.0.20326.20090 |
| CVE-2026-21511 | 7.5 | Feb 10 | Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network Affected: before 16.0.19127.20518; 2016; 2019 |
| CVE-2026-21260 | 7.5 | Feb 10 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network Affected: before 16.0.19127.20518; 2016; 2019 |
| CVE-2024-43466 | 7.5 | Sep 10 | Microsoft SharePoint Server Denial of Service Vulnerability Affected: 2016; 2019 |
| CVE-2024-32987 | 7.5 | Jul 9 | Microsoft SharePoint Server Information Disclosure Vulnerability Affected: 2016; 2019 |
| CVE-2024-30043 | 7.5 | May 14 | Microsoft SharePoint Server Information Disclosure Vulnerability Affected: before 16.0.17328.20292; 2016; 2019 |
| CVE-2023-33165 | 7.5 | Jul 11 | Microsoft SharePoint Server Security Feature Bypass Vulnerability Affected: 2019 |
| CVE-2019-1006 | 7.5 | Jul 15 | An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary… Affected: 2019 |
| CVE-2026-105013 | 7.4 | Oct 13 | Microsoft Office SharePoint Remote Code Execution Vulnerability Affected: before 16.0.20326.20190 |
| CVE-2024-49070 | 7.4 | Dec 12 | Microsoft SharePoint Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2020-1345 | 7.4 | Sep 11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2019 |
| CVE-2020-1198 | 7.4 | Sep 11 | <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server Affected: 2019 |
| CVE-2026-88204 | 7.3 | Oct 13 | Microsoft Office SharePoint Spoofing Vulnerability Affected: before 16.0.20326.20190 |
| CVE-2023-36762 | 7.3 | Sep 12 | Microsoft Word Remote Code Execution Vulnerability Affected: 2016 |
| CVE-2023-33130 | 7.3 | Jun 14 | Microsoft SharePoint Server Spoofing Vulnerability Affected: 2019 |
| CVE-2016-0025 | 7.3 | Jun 16 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack… Affected: 2010; 2013 |
| CVE-2026-70267 | 7.2 | Oct 13 | Microsoft Office SharePoint Remote Code Execution Vulnerability Affected: before 16.0.20326.20190 |
| CVE-2025-29793 | 7.2 | Apr 8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network Affected: before 16.0.18526.20172; 2019 |
| CVE-2025-21348 | 7.2 | Jan 14 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.17928.20356; 2016; 2019 |
| CVE-2024-38228 | 7.2 | Sep 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2024-38227 | 7.2 | Sep 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2024-43464 | 7.2 | Sep 10 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2024-38024 | 7.2 | Jul 9 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2024-38023 | 7.2 | Jul 9 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2016; 2019 |
| CVE-2024-30044 | 7.2 | May 14 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: before 16.0.17328.20292; 2016; 2019 |
| CVE-2021-42294 | 7.2 | Dec 15 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2019 |
| CVE-2021-31966 | 7.2 | Jun 8 | Microsoft SharePoint Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2025-59235 | 7.1 | Oct 14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally Affected: 2016; 2019 |
| CVE-2025-59232 | 7.1 | Oct 14 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally Affected: 2016; 2019 |
| CVE-2025-54905 | 7.1 | Sep 9 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally Affected: 2019 |
The 500 most important CVEs for this product (exploited first, then by severity)