Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2768▼ 554 respecto a la semana anterior

Críticas / altas1325▼ 178 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)268▼ 242 respecto a la semana anterior

736 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-62204	Analizada	Alta (8)	2.1%	—	Microsoft Sharepoint Server	11/11/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-59237	Analizada	Alta (8.8)	2.5%	—	Microsoft Sharepoint Server	14/10/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-59235	Analizada	Alta (7.1)	0.66%	—	Microsoft 365 Apps Microsoft Access Microsoft Excel Microsoft Office+3	14/10/2025	17/6/2026	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-59232	Analizada	Alta (7.1)	0.48%	—	Microsoft 365 Apps Microsoft Access Microsoft Excel Microsoft Office+3	14/10/2025	17/6/2026	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2025-59228	Analizada	Alta (8.8)	1.4%	—	Microsoft Sharepoint Server	14/10/2025	17/6/2026	Improper input validation in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-59222	Analizada	Alta (7.8)	0.47%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Server+1	14/10/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-59221	Analizada	Alta (7)	0.39%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Server+1	14/10/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-54906	Analizada	Alta (7.8)	0.71%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Server	9/9/2025	17/6/2026	Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-54905	Analizada	Alta (7.1)	0.63%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	9/9/2025	17/6/2026	Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2025-54897	Analizada	Alta (8.8)	20%	💥 PoC	Microsoft Sharepoint Server	9/9/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-53760	Analizada	Alta (7.1)	16%	—	Microsoft Sharepoint Server	12/8/2025	17/6/2026	Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2025-53736	Analizada	Media (6.2)	0.50%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	12/8/2025	17/6/2026	Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2025-53733	Analizada	Alta (8.4)	0.55%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	12/8/2025	17/6/2026	Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-49712	Analizada	Alta (8.8)	19%	—	Microsoft Sharepoint Server	12/8/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-53771	Analizada	Media (6.5)	100%	💥 Exploit	Microsoft Sharepoint Server	20/7/2025	17/6/2026	Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-53770	Analizada	Crítica (9.8)	100%	⚠ Explotación activa💥 Exploit	Microsoft Sharepoint Server	20/7/2025	4/8/2026	Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the…
CVE-2025-49706	Analizada	Media (6.5)	99%	⚠ Explotación activa💥 Exploit	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	8/7/2025	4/8/2026	Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-49704	Analizada	Alta (8.8)	100%	⚠ Explotación activa💥 Exploit	Microsoft Sharepoint Server	8/7/2025	17/6/2026	Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-49703	Analizada	Alta (7.8)	0.67%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Server+1	8/7/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-49701	Analizada	Alta (8.8)	1.2%	—	Microsoft Sharepoint Server	8/7/2025	17/6/2026	Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-47994	Analizada	Alta (8.6)	3.0%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server	8/7/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.
CVE-2025-47172	Analizada	Alta (8.8)	1.7%	—	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	10/6/2025	17/6/2026	Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-47169	Analizada	Alta (7.8)	0.65%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	10/6/2025	17/6/2026	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-47168	Analizada	Alta (7.8)	0.64%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	10/6/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-47166	Analizada	Alta (8.8)	21%	💥 Exploit	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	10/6/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.