Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,898 results · page 20 of 58
Aug 12, 2025Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2025-53736 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-53735 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.CVE-2025-53734 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-53733 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-53732 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-53731 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.CVE-2025-53730 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-49712 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2025Woffice Core: Arbitrary file deletionCVE-2025-7694 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Woffice Core
- Affected
- up to 5.4.26
- What to do
- Affects up to 5.4.26. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhub.woffice.iothemeforest.net
Jul 24, 2025ONLYOFFICE Docs: Privilege EscalationCVE-2025-6380 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment ID maps to an existing attachment post, but does not verify the requester’s identity or capabilities. This makes it possible for unauthenticated attackers to log in as an arbitrary user.
- Product
- ONLYOFFICE Docs
- Affected
- 1.1.0 to 2.2.0
- What to do
- Affects 1.1.0 to 2.2.0. Update ONLYOFFICE Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 20, 2025Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.CVE-2025-53771 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.combleepingcomputer.com
Jul 14, 2025A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd.CVE-2025-7628 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. It has been classified as critical. This affects the function deleteFile of the file /deleteFile. The manipulation of the argument fileName leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical.CVE-2025-7627 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this issue is the function fileUpload of the file /fileUpload. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical.CVE-2025-7626 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this vulnerability is the function onlinePreview of the file /onlinePreview. The manipulation of the argument url leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd.CVE-2025-7625 · Other software · YiJiuSmile · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the function Download of the file /download. The manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- kkFileViewOfficeEdit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature locally.CVE-2025-49756 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comLow 3.3
Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-49711 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-49705 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-49703 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49702 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-49701 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-49700 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49699 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-49698 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49697 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49696 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-49695 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2025-48812 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.CVE-2025-47994 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.CVE-2025-45938 · Other software · Akeles · reported by MITREMedium 5.4
Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.
- Product
- OUT Of Office Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.akeles.comy-security.de
Jun 26, 2025An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface.CVE-2025-34046 · Other software · Shanghai Fanwei Network Technology · reported by VulnCheckCritical 10
An unauthenticated file upload vulnerability exists in the Fanwei E-Office <= v9.4 web management interface. The vulnerability affects the /general/index/UploadFile.php endpoint, which improperly validates uploaded files when invoked with certain parameters (uploadType=eoffice_logo or uploadType=theme). An attacker can exploit this flaw by sending a crafted HTTP POST request to upload arbitrary files without requiring authentication. Successful exploitation could enable remote code execution on the affected server, leading to complete compromise of the web application and potentially the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
- Product
- E-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48993 · Other software · Intermesh · reported by GitHubMedium 5.3
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web application does not sanitize their input. This could result in a reflected cross-site scripting (XSS) attack. This issue has been patched in versions 6.8.123 and 25.0.27.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48992 · Other software · Intermesh · reported by GitHubMedium 5.2
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerability exists in the Name Field of the user profile. A malicious attacker can change their name to a javascript payload, which is executed when a user adds the malicious user to their Synchronization > Address books. This issue has been patched in versions 6.8.123 and 25.0.27.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI CVE-2025-5301 · Other software · OnlyOffice · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.1
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
- Product
- Docs (DocumentServer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comr.sec-consult.com
Jun 10, 2025Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-32717 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47957 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47953 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.CVE-2025-47176 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-47175 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-47174 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47173 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute codCVE-2025-47172 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.CVE-2025-47171 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47170 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-47168 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47167 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-47166 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-47165 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47164 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.