Microsoft Sharepoint Server vulnerabilities
629 vulnerabilities
Known vulnerabilities in Microsoft Sharepoint Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-108452microsoftmicrosoft sharepoint server subscription edition+1
EPSS score0.63%
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-97783microsoftmicrosoft sharepoint server 2019+1EPSS score0.50%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.CVE-2026-97782microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.53%
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.CVE-2026-97755microsoft365_apps+12EPSS score0.78%
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-96044microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.73%
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-88209microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.36%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-88208microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.27%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-88206microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.51%
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-88204microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.63%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-88200microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.70%
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-88198microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.70%
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-88166microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.82%
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-88163microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.82%
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-88155microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.82%
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-85932microsoftmicrosoft sharepoint server subscription edition+1EPSS score1.04%
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-85900microsoftmicrosoft sharepoint server subscription edition+1EPSS score1.52%
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-70298microsoftmicrosoft sharepoint server subscription edition+1EPSS score1.09%
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-70267microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.90%
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-70266microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.95%
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-70259microsoftmicrosoft sharepoint server subscription edition+1EPSS score0.81%
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.