Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-48562 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-48560 Microsoft US
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
EPSS 0.35 CVE-2026-45484 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45481 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-47640 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-47634 Microsoft US
Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-47293 Microsoft US
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-45647 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-45644 Microsoft US
Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-45476 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45465 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45464 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45462 Microsoft US
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
EPSS 0.02 CVE-2026-45454 Microsoft veřejná správa finance zdravotnictví školství US
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-42835 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-33113 Microsoft US
Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.
EPSS 0.00 CVE-2026-49161 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-47641 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-47639 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-47638 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-47637 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-47635 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-47631 Microsoft US
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.
EPSS 0.00 CVE-2026-32193 Microsoft US
Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-41092 Microsoft US
User interface (ui) misrepresentation of critical information in Microsoft Bing allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45650 Microsoft US
Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack.
EPSS 0.00 CVE-2026-45642 Microsoft US
Out-of-bounds read in Microsoft UxTheme Library (uxtheme.dll) allows an authorized attacker to deny service locally.
EPSS 0.00 CVE-2026-45606 Microsoft US
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-45583 Microsoft US
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
EPSS 0.00 CVE-2026-45503 Microsoft US
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
EPSS 0.20 CVE-2026-45502 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-45501 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-45500 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45453 Microsoft US
Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-42902 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45483 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45479 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45468 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-45467 Microsoft US
Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-41108 Microsoft US
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-47298 Microsoft US
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
EPSS 0.00 CVE-2026-45482 Microsoft GitHub US
Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-40371 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-47636 Microsoft US
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-45463 Microsoft US
Protection mechanism failure in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
EPSS 0.00 CVE-2026-45459 Microsoft US
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-45457 Microsoft US
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-45455 Microsoft US
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-44822 Microsoft US
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-45645 Microsoft US
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-45643 Microsoft US
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-45466 Microsoft US
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-45461 Microsoft US
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-45460 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-45458 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-45456 Microsoft US
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-44824 Microsoft US
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-44823 Microsoft US
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-44821 Microsoft US
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-44820 Microsoft US