| CVE-2025-62555 | 高7.0 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 09/12/2025 |
| CVE-2025-62204 | 高8.0 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 11/11/2025 |
| CVE-2025-59237 | 高8.8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 14/10/2025 |
| CVE-2025-59235 | 高7.1 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 14/10/2025 |
| CVE-2025-59232 | 高7.1 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 14/10/2025 |
| CVE-2025-59228 | 高8.8 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 14/10/2025 |
| CVE-2025-59222 | 高7.8 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 14/10/2025 |
| CVE-2025-59221 | 高7.0 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 14/10/2025 |
| CVE-2025-54906 | 高7.8 | Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. | 09/09/2025 |
| CVE-2025-54905 | 高7.1 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 09/09/2025 |
| CVE-2025-54897 | 高8.8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 09/09/2025 |
| CVE-2025-53760 | 高7.1 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 12/08/2025 |
| CVE-2025-53736 | 中6.2 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 12/08/2025 |
| CVE-2025-53733 | 高8.4 | Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 12/08/2025 |
| CVE-2025-49712 | 高8.8 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 12/08/2025 |
| CVE-2025-53771 | 中6.5 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 20/07/2025 |
| CVE-2025-53770KEV | 緊急9.8 | Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.
Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild.
Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the me | 20/07/2025 |
| CVE-2025-49706KEV | 中6.5 | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 08/07/2025 |
| CVE-2025-49704KEV | 高8.8 | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 08/07/2025 |
| CVE-2025-49703 | 高7.8 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 08/07/2025 |