Veille CVE

Juillet 2026

88 CVE

Critique 6 Élevée 57 Moyenne 20 Faible 5 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Microsoft microsoft 365 » ✕
  1. CVE-2026-50517 9.9 Critique

    Microsoft 365 Copilot

    Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

  2. CVE-2026-15212 8.8 Élevée

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

    The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  3. CVE-2026-59864 9.3 Critique

    microsoft kiota

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5.

  4. CVE-2026-54733 9.3 Critique

    microsoft o365-moodle

    The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.

  5. CVE-2026-58617 9.8 Critique

    Microsoft 365 Copilot for iOS · Microsoft 365 copilot

    Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

  6. CVE-2026-56195 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  7. CVE-2026-56192 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  8. CVE-2026-56176 7.8 Élevée

    Microsoft Office 365 for Mac · Microsoft Office for Android · Microsoft Office LTSC for Mac 2021 · Microsoft Office LTSC for Mac 2024

    Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

  9. CVE-2026-56156 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  10. CVE-2026-55949 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  11. CVE-2026-55947 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  12. CVE-2026-55898 7.1 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  13. CVE-2026-55142 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  14. CVE-2026-55141 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  15. CVE-2026-55140 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  16. CVE-2026-55139 3.3 Faible

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  17. CVE-2026-55138 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  18. CVE-2026-55137 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  19. CVE-2026-55136 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  20. CVE-2026-55134 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  21. CVE-2026-55133 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 365 for Mac · Microsoft Office LTSC for Mac 2021 · Microsoft Office LTSC for Mac 2024

    Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally.

  22. CVE-2026-55132 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  23. CVE-2026-55131 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  24. CVE-2026-55130 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office LTSC 2021 · Microsoft Office LTSC 2024

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  25. CVE-2026-55129 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  26. CVE-2026-55128 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  27. CVE-2026-55127 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  28. CVE-2026-55125 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  29. CVE-2026-55124 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  30. CVE-2026-55123 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  31. CVE-2026-55122 7.1 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  32. CVE-2026-55121 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  33. CVE-2026-55120 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  34. CVE-2026-55058 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  35. CVE-2026-55057 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

  36. CVE-2026-55056 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  37. CVE-2026-55055 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  38. CVE-2026-55054 6.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  39. CVE-2026-55053 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  40. CVE-2026-55050 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  41. CVE-2026-55049 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  42. CVE-2026-55048 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  43. CVE-2026-55047 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  44. CVE-2026-55046 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  45. CVE-2026-55045 8.4 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.

  46. CVE-2026-55044 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  47. CVE-2026-55043 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.

  48. CVE-2026-55042 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

  49. CVE-2026-55041 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  50. CVE-2026-55039 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  51. CVE-2026-55038 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  52. CVE-2026-55037 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  53. CVE-2026-55036 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  54. CVE-2026-55035 3.3 Faible

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  55. CVE-2026-55033 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  56. CVE-2026-55032 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  57. CVE-2026-55031 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  58. CVE-2026-55029 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  59. CVE-2026-55028 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  60. CVE-2026-55027 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  61. CVE-2026-55026 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.

  62. CVE-2026-55025 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  63. CVE-2026-55024 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  64. CVE-2026-55023 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  65. CVE-2026-55022 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

  66. CVE-2026-55018 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  67. CVE-2026-55017 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office LTSC 2021

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  68. CVE-2026-54131 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  69. CVE-2026-50665 3.3 Faible

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  70. CVE-2026-50467 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  71. CVE-2026-50408 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  72. CVE-2026-50387 7.8 Élevée

    Microsoft Office 365 for Mac · Microsoft Office for Android · Microsoft Office LTSC for Mac 2021 · Microsoft Office LTSC for Mac 2024

    Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

  73. CVE-2026-50365 8.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.

  74. CVE-2026-50314 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  75. CVE-2026-50301 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office LTSC 2021

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  76. CVE-2026-48580 5.5 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  77. CVE-2026-47642 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office LTSC 2021

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  78. CVE-2026-47290 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office LTSC 2021

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  79. CVE-2026-58618 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  80. CVE-2026-56193 3.3 Faible

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  81. CVE-2026-55948 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  82. CVE-2026-55899 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  83. CVE-2026-54988 6.1 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  84. CVE-2026-50678 3.3 Faible

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  85. CVE-2026-50675 7.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Excel 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  86. CVE-2026-48561 9.6 Critique

    Microsoft Edge Copilot for Android · Microsoft Edge Copilot for IOS · Microsoft 365 copilot

    Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

  87. CVE-2026-47646 6.1 Moyenne

    Microsoft Dynamics 365 Customer Voice

    Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

  88. CVE-2026-41106 9.3 Critique

    Microsoft 365 Copilot

    Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.