Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,898 results · page 21 of 58
Jun 10, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-47163 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2025Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-47162 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1.CVE-2025-5877 · Other software · Fengoffice · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml external entity reference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Feng Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 6, 2025onOffice for WP-Websites: Missing AuthorizationCVE-2025-30958 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onOffice for WP-Websites: from n/a through <= 6.5.1.
- Product
- onOffice for WP-Websites
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update onOffice for WP-Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2025A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical.CVE-2025-5433 · Other software · Fengoffice · reported by VulDBMedium 5.3
A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index.php?c=account&a=set_timezone. The manipulation of the argument tz_offset leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Feng Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats.CVE-2025-48882 · Websites & servers · PHPOffice · reported by GitHubHigh 8.7
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. Version 0.3.0 fixes the vulnerability.
- Product
- Math
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2025Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network CVE-2025-2146 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdCritical 9.8
Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.
- Product
- Satera MF656Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48369 · Other software · Intermesh · reported by GitHubMedium 5.3
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting (XSS) vulnerability exists in Groupoffice's tasks comment functionality, allowing attackers to execute arbitrary JavaScript by uploading an file with a crafted filename. When administrators or other users view the task containing this malicious file, the payload executes in their browser context. The application fails to sanitize image filenames before rendering them in the comment. By uploading an image with a crafted filename containing XSS payloads, attackers can steal sensitive information. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48368 · Other software · Intermesh · reported by GitHubMedium 5.8
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a DOM-based Cross-Site Scripting (XSS) vulnerability exists in the GroupOffice application, allowing attackers to execute arbitrary JavaScript code in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability can be triggered by injecting a crafted payload into a parameter that is later processed unsafely in the DOM. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2025Group-Office is an enterprise customer relationship management and groupware tool.CVE-2025-48366 · Other software · Intermesh · reported by GitHubMedium 6.9
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persistent JavaScript payloads, which are triggered in the context of another user when they view the Address Book. Successful exploitation enables actions such as forced redirects, unauthorized fetch requests, or other arbitrary JavaScript execution without user interaction. Versions 6.8.119 and 25.0.20 contain a fix for the issue.
- Product
- groupoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025SQL injection vulnerability in Comerzzia Backoffice: Sales Orchestrator 3.0.15.CVE-2025-40635 · Other software · Comerzzia · reported by cve-coordination@incibe.esCritical 9.3
SQL injection vulnerability in Comerzzia Backoffice: Sales Orchestrator 3.0.15. This vulnerability allows an attacker to retrieve, create, update and delete databases via the ‘uidActivity’, ‘codCompany’ and ‘uidInstance’ parameters of the ‘/comerzzia/login’ endpoint.
- Product
- Comerzzia Backoffice: Sales Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2025A passback vulnerability which relates to office/small office multifunction printers and laser printers.CVE-2025-3079 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdMedium 6.3
A passback vulnerability which relates to office/small office multifunction printers and laser printers.
- Product
- imageRUNNER Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcanon.jpcorporate.jp.canon
May 19, 2025A passback vulnerability which relates to production printers and office multifunction printers.CVE-2025-3078 · Other software · Canon Inc. · reported by f98c90f0-e9bd-4fa7-911b-51993f3571fdMedium 6.3
A passback vulnerability which relates to production printers and office multifunction printers.
- Product
- imageRUNNER ADVANCE Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcanon.jpcorporate.jp.canon
May 14, 2025An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file.CVE-2024-57096 · Other software · Kingsoft · reported by MITREMedium 5.5
An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file.
- Product
- WPS Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.CVE-2025-32705 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-32704 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30393 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.CVE-2025-30388 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.
- Product
- Microsoft Office for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-30386 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-30384 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.4
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30383 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-30382 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30381 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30379 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-30378 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-30377 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30376 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-30375 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-29979 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2025-29978 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-29977 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.CVE-2025-29976 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation.CVE-2025-2866 · Other software · The Document Foundation · reported by security@documentfoundation.orgLow 2.4
Improper Verification of Cryptographic Signature vulnerability in LibreOffice allows PDF Signature Spoofing by Improper Validation. In the affected versions of LibreOffice a flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid This issue affects LibreOffice: from 24.8 before < 24.8.6, from 25.2 before < 25.2.2.
- Product
- LibreOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlibreoffice.orglists.debian.org
Apr 23, 2025A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash the firewall, potentiCVE-2025-32818 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.5
A Null Pointer Dereference vulnerability in the SonicOS SSLVPN Virtual office interface allows a remote, unauthenticated attacker to crash the firewall, potentially leading to a Denial-of-Service (DoS) condition.
- Product
- SonicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Apr 17, 2025Office Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32665 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebbyTemplate Office Locator office-locator allows SQL Injection.This issue affects Office Locator: from n/a through <= 1.3.0.
- Product
- Office Locator
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Office Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion (component: Core Smart View).CVE-2025-30737 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.7
Vulnerability in the Oracle Smart View for Office product of Oracle Hyperion (component: Core Smart View). The supported version that is affected is 24.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Smart View for Office. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Smart View for Office accessible data as well as unauthorized access to critical data or complete access to all Oracle Smart View for Office accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N).
- Product
- Oracle Smart View for Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Collabora Online is a collaborative online office suite based on LibreOffice technology.CVE-2025-27791 · Other software · CollaboraOnline · reported by GitHubHigh 8.3
Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a path traversal flaw in handling the CheckFileInfo BaseFileName field returned from WOPI servers. This allows for a file to be written anywhere the uid running Collabora Online can write, if such a response was supplied by a malicious WOPI server. By combining this flaw with a Time of Check, Time of Use DNS lookup issue with a WOPI server address under attacker control, it is possible to present such a response to be processed by a Collabora Online instance. This issue has been patched in versions 24.04.13.1, 23.05.19, and 22.05.25.
- Product
- online
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-29823 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.CVE-2025-29822 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-29820 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-29816 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-29794 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-29793 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.2
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.CVE-2025-29792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-29791 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-27752 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-27751 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-27750 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-27749 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-27748 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.