sharepoint_server vulnerabilities
CVEs whose affected-version data names the sharepoint_server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
86 CVEsRSS
CVE-2026-97783High· 8.1Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-97782Medium· 6.8Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
CVE-2026-97755High· 8.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-96044High· 8.8No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-88209Medium· 4.6Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-88208Medium· 4.6Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-88206High· 7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-88204High· 7.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-88200High· 8.8Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Privilege context switching error in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-88198High· 8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-88166High· 8.8Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-88163High· 8.8Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Integer overflow or wraparound in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-88155High· 8.8Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-85932Medium· 6.5Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-85900High· 8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-70298Medium· 6.5Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-70267High· 7.2Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-70266High· 8.8Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-70259Medium· 6.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-70251High· 7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-70246High· 8.8Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-70217Medium· 4.9Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-70202High· 7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-69943High· 8.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-105720Medium· 4.3Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-105719Medium· 6.5Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-105713Medium· 5.7Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
CVE-2026-105013High· 7.4Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-102866High· 8.1Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-102865Medium· 6.5Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.