Known vulnerabilities in Microsoft SharePoint Server - page 6

Vendor: Microsoft
Software: Microsoft SharePoint Server
Software CPE: cpe:2.3:a:microsoft:microsoft_sharepoint_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 532
Public exploits: 24
Known exploited (KEV): 19
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft SharePoint Server Microsoft SharePoint Server is affected by 532 known vulnerabilities: 4 critical, 122 high, 211 medium, 195 low Critical High Medium Low

Vulnerabilities (532)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131345 - Deserialization of Untrusted Data
CVE-2026-40357		 CWE-502 Medium
No
No
 16.0.10417.20128 13.05.2026 SB2026051368
#VU131344 - Deserialization of Untrusted Data
CVE-2026-33112		 CWE-502 Medium
No
No
 16.0.10417.20128 13.05.2026 SB2026051368
#VU131343 - Deserialization of Untrusted Data
CVE-2026-33110		 CWE-502 Medium
No
No
 16.0.10417.20128 13.05.2026 SB2026051368
#VU131342 - Deserialization of Untrusted Data
CVE-2026-35439		 CWE-502 Medium
No
No
 16.0.10417.20128 13.05.2026 SB2026051368
#VU131341 - Deserialization of Untrusted Data
CVE-2026-40368		 CWE-502 Medium
No
No
 16.0.10417.20128 13.05.2026 SB2026051368
#VU131340 - Insufficient Granularity of Access Control
CVE-2026-40365		 CWE-1220 Medium
No
No
 16.0.10417.20128 13.05.2026 SB2026051368
#VU126065 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20945		 CWE-79 Low
No
No
 16.0.10417.20114 14.04.2026 SB20260414165
#VU126005 - Improper input validation
CVE-2026-32201		 CWE-20 High
Available
Exploited
 16.0.5548.1003, 16.0.10417.20114, 16.0.19725.20210 14.04.2026 SB20260414129
#VU123867 - Untrusted Pointer Dereference
CVE-2026-26113		 CWE-822 High
No
No
 16.0.10417.20102 11.03.2026 SB2026031116
#VU123814 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-26105		 CWE-79 Low
No
No
 16.0.10417.20102 11.03.2026 SB2026031107
#VU123813 - Deserialization of Untrusted Data
CVE-2026-26114		 CWE-502 Medium
No
No
 16.0.10417.20102 11.03.2026 SB2026031107
#VU123812 - Improper input validation
CVE-2026-26106		 CWE-20 Medium
No
No
 16.0.10417.20102 11.03.2026 SB2026031107
#VU122587 - Deserialization of Untrusted Data
CVE-2026-21511		 CWE-502 Medium
No
No
 - 10.02.2026 SB2026021093
#VU122586 - Exposure of sensitive information to an unauthorized actor
CVE-2026-21260		 CWE-200 Medium
No
No
 - 10.02.2026 SB2026021093
#VU121459 - Untrusted Pointer Dereference
CVE-2026-20948		 CWE-822 High
No
No
 - 14.01.2026 SB20260114105
#VU121455 - Untrusted Search Path
CVE-2026-20943		 CWE-426 High
No
No
 - 14.01.2026 SB20260114104
#VU121422 - Deserialization of Untrusted Data
CVE-2026-20963		 CWE-502 Medium
No
Exploited
 - 14.01.2026 SB2026011474
#VU121420 - Server-Side Request Forgery (SSRF)
CVE-2026-20958		 CWE-918 Medium
No
No
 - 14.01.2026 SB2026011474
#VU121327 - Improper input validation
CVE-2026-20951		 CWE-20 High
No
No
 - 13.01.2026 SB20260113125
#VU121324 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-20947		 CWE-89 Medium
No
No
 - 13.01.2026 SB20260113125


Showing elements 101 - 120 out of 532