rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-20926 Windows SMB Server Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:42.320Z
CVE-2026-20927 Windows SMB Server Denial of Service Vulnerability
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:42.801Z
CVE-2026-20928 Windows Recovery Environment Security Feature Bypass Vulnerability
Problem types: cwe_id: CWE-212
description: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows 11 version 26H1
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2026-04-14T16:57:51.238Z
CVE-2026-20929 Windows HTTP.sys Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:02.860Z
CVE-2026-20930 Windows Management Services Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-04-14T16:56:51.780Z
CVE-2026-20931 Windows Telephony Service Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-73
description: CWE-73: External Control of File Name or Path
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:03.440Z
CVE-2026-20932 Windows File Explorer Information Disclosure Vulnerability
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:43.380Z
CVE-2026-20934 Windows SMB Server Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-362
description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:43.877Z
CVE-2026-20935 Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:03.986Z
CVE-2026-20936 Windows NDIS Information Disclosure Vulnerability
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:04.676Z
CVE-2026-20937 Windows File Explorer Information Disclosure Vulnerability
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:05.336Z
CVE-2026-20938 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:44.374Z
CVE-2026-20939 Windows File Explorer Information Disclosure Vulnerability
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
vendor: Microsoft
product: Windows Server 2022, 23H2 Edition (Server Core installation)
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:05.926Z
CVE-2026-20940 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 21H2
vendor: Microsoft
product: Windows 10 Version 22H2
vendor: Microsoft
product: Windows 11 version 22H3
vendor: Microsoft
product: Windows 11 Version 23H2
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows Server 2022
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:44.942Z
CVE-2026-20941 Host Process for Windows Tasks Elevation of Privilege Vulnerability
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: Microsoft
product: Windows 11 Version 24H2
vendor: Microsoft
product: Windows 11 Version 25H2
vendor: Microsoft
product: Windows Server 2025
vendor: Microsoft
product: Windows Server 2025 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:10.464Z
CVE-2026-20943 Microsoft Office Click-To-Run Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-426
description: CWE-426: Untrusted Search Path
Affected products: vendor: Microsoft
product: Microsoft Office 2016
vendor: Microsoft
product: Microsoft Office Deployment Tool
vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
vendor: Microsoft
product: Microsoft SharePoint Server 2019
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:45.424Z
CVE-2026-20944 Microsoft Word Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.4
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:45.984Z
CVE-2026-20945 Microsoft SharePoint Server Spoofing Vulnerability
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
vendor: Microsoft
product: Microsoft SharePoint Server 2019
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C
Published: 2026-04-14T16:56:55.466Z
CVE-2026-20946 Microsoft Excel Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Excel 2016
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:46.499Z
CVE-2026-20947 Microsoft SharePoint Server Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
vendor: Microsoft
product: Microsoft SharePoint Server 2019
vendor: Microsoft
product: Microsoft SharePoint Server Subscription Edition
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:56:52.105Z
CVE-2026-20948 Microsoft Word Remote Code Execution Vulnerability
Problem types: cwe_id: CWE-822
description: CWE-822: Untrusted Pointer Dereference
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office 2019
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
vendor: Microsoft
product: Microsoft SharePoint Enterprise Server 2016
vendor: Microsoft
product: Microsoft SharePoint Server 2019
vendor: Microsoft
product: Microsoft Word 2016
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:06.605Z
CVE-2026-20949 Microsoft Excel Security Feature Bypass Vulnerability
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Microsoft
product: Microsoft 365 Apps for Enterprise
vendor: Microsoft
product: Microsoft Office LTSC 2021
vendor: Microsoft
product: Microsoft Office LTSC 2024
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2021
vendor: Microsoft
product: Microsoft Office LTSC for Mac 2024
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Published: 2026-01-13T17:57:07.146Z