Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2647▼ 688 respecto a la semana anterior

Críticas / altas1257▼ 290 respecto a la semana anterior

Nueva explotación activa (KEV)3▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)226▼ 277 respecto a la semana anterior

2573 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-62216	Analizada	Alta (7.8)	0.41%	—	Microsoft 365 Apps Microsoft Office Long Term Servicing Channel	11/11/2025	17/6/2026	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-62205	Analizada	Alta (7.8)	0.41%	—	Microsoft 365 Apps Microsoft Office Long Term Servicing Channel	11/11/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-62203	Analizada	Alta (7.8)	0.51%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	11/11/2025	17/6/2026	Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62202	Analizada	Alta (7.1)	0.52%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	11/11/2025	17/6/2026	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-62201	Analizada	Alta (7.8)	0.48%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	11/11/2025	17/6/2026	Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62200	Analizada	Alta (7.8)	0.48%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	11/11/2025	17/6/2026	Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62199	Modificada	Alta (7.8)	0.76%	—	Microsoft 365 Apps Microsoft 365 Copilot Microsoft Excel Microsoft Office Long Term Servicing Channel	11/11/2025	17/6/2026	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-60728	Analizada	Media (4.3)	0.72%	—	Microsoft 365 Apps Microsoft Office Long Term Servicing Channel	11/11/2025	17/6/2026	Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2025-60727	Analizada	Alta (7.8)	0.64%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	11/11/2025	17/6/2026	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-60726	Analizada	Alta (7.1)	0.58%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	11/11/2025	17/6/2026	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-60724	Analizada	Crítica (9.8)	5.9%	—	Microsoft 365 Copilot Microsoft Office Long Term Servicing Channel Microsoft Windows 10 1607 Microsoft Windows 10 1809+12	11/11/2025	17/6/2026	Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
CVE-2025-59240	Analizada	Media (5.5)	0.59%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel	11/11/2025	17/6/2026	Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-12865	Analizada	Alta (8.7)	0.36%	—	Edetw U-office Force	10/11/2025	7/10/2026	U-Office Force desarrollado por e-Excellence tiene una vulnerabilidad de inyección SQL, permitiendo a un atacante remoto autenticado inyectar comandos SQL arbitrarios para leer, modificar y eliminar contenidos de la base de datos.
CVE-2025-12864	Analizada	Alta (8.7)	0.36%	—	Edetw U-office Force	10/11/2025	7/10/2026	U-Office Force desarrollado por e-Excellence tiene una vulnerabilidad de inyección SQL, que permite a un atacante remoto autenticado inyectar comandos SQL arbitrarios para leer, modificar y eliminar el contenido de la base de datos.
CVE-2025-10348	Aplazada	Media (5.1)	0.35%	—	Urve Smart Office^AI	30/10/2025	8/10/2026	URVE Smart Office es vulnerable a XSS Almacenado en la funcionalidad de reportar problemas. Un atacante con una cuenta de bajos privilegios puede subir un archivo SVG que contenga una carga útil maliciosa, la cual se ejecutará cuando una víctima visite la URL del recurso subido. El recurso está disponible para…
CVE-2025-10045	Aplazada	Media (4.9)	0.37%	—	Onoffice FOR WP Websites^AI	15/10/2025	8/10/2026	El plugin onOffice para WP-Websites para WordPress es vulnerable a inyección SQL a través del parámetro 'order' en todas las versiones hasta la 5.7, inclusive, debido a un escape insuficiente en el parámetro proporcionado por el usuario y la falta de preparación suficiente en la consulta SQL existente. Esto hace…
CVE-2025-59243	Analizada	Alta (7.8)	0.45%	—	Microsoft 365 Apps Microsoft Office Long Term Servicing Channel	14/10/2025	17/6/2026	Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-59238	Analizada	Alta (7.8)	0.38%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Powerpoint	14/10/2025	17/6/2026	Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
CVE-2025-59236	Analizada	Alta (7.8)	0.42%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Office Online Server	14/10/2025	17/6/2026	Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-59235	Analizada	Alta (7.1)	0.66%	—	Microsoft 365 Apps Microsoft Access Microsoft Excel Microsoft Office+3	14/10/2025	17/6/2026	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-59234	Analizada	Alta (7.8)	0.60%	—	Microsoft 365 Apps Microsoft 365 Copilot Microsoft Office Microsoft Office Long Term Servicing Channel	14/10/2025	17/6/2026	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-59233	Analizada	Alta (7.8)	0.53%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	14/10/2025	17/6/2026	Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-59232	Analizada	Alta (7.1)	0.48%	—	Microsoft 365 Apps Microsoft Access Microsoft Excel Microsoft Office+3	14/10/2025	17/6/2026	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-59231	Analizada	Alta (7.8)	0.53%	—	Microsoft 365 Apps Microsoft Excel Microsoft Office Microsoft Office Long Term Servicing Channel+1	14/10/2025	17/6/2026	Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-59229	Analizada	Media (5.5)	0.42%	—	Microsoft 365 Apps Microsoft Office Long Term Servicing Channel	14/10/2025	17/6/2026	Uncaught exception in Microsoft Office allows an unauthorized attacker to deny service locally.