Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2855▼ 333 respecto a la semana anterior

Críticas / altas1381▼ 36 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)296▼ 213 respecto a la semana anterior

619 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2025-59221	Analizada	Alta (7)	0.39%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Server+1	14/10/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-54906	Analizada	Alta (7.8)	0.71%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Server	9/9/2025	17/6/2026	Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-54905	Analizada	Alta (7.1)	0.63%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	9/9/2025	17/6/2026	Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2025-54897	Analizada	Alta (8.8)	20%	💥 PoC	Microsoft Sharepoint Server	9/9/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-53760	Analizada	Alta (7.1)	16%	—	Microsoft Sharepoint Server	12/8/2025	17/6/2026	Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2025-53736	Analizada	Media (6.2)	0.50%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	12/8/2025	17/6/2026	Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2025-53733	Analizada	Alta (8.4)	0.55%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	12/8/2025	17/6/2026	Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-49712	Analizada	Alta (8.8)	19%	—	Microsoft Sharepoint Server	12/8/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-53771	Analizada	Media (6.5)	100%	💥 Exploit	Microsoft Sharepoint Server	20/7/2025	17/6/2026	Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-53770	Analizada	Crítica (9.8)	100%	⚠ Explotación activa💥 Exploit	Microsoft Sharepoint Server	20/7/2025	4/8/2026	Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the…
CVE-2025-49706	Analizada	Media (6.5)	99%	⚠ Explotación activa💥 Exploit	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	8/7/2025	4/8/2026	Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-49704	Analizada	Alta (8.8)	100%	⚠ Explotación activa💥 Exploit	Microsoft Sharepoint Server	8/7/2025	17/6/2026	Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-49703	Analizada	Alta (7.8)	0.67%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Server+1	8/7/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-49701	Analizada	Alta (8.8)	1.2%	—	Microsoft Sharepoint Server	8/7/2025	17/6/2026	Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-47172	Analizada	Alta (8.8)	1.7%	—	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	10/6/2025	17/6/2026	Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-47169	Analizada	Alta (7.8)	0.65%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	10/6/2025	17/6/2026	Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-47168	Analizada	Alta (7.8)	0.64%	—	Microsoft 365 Apps Microsoft Office Microsoft Office Long Term Servicing Channel Microsoft Sharepoint Enterprise Server+2	10/6/2025	17/6/2026	Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-47166	Analizada	Alta (8.8)	21%	💥 Exploit	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	10/6/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-47163	Analizada	Alta (8.8)	20%	—	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	10/6/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-30384	Analizada	Alta (7)	1.3%	—	Microsoft Sharepoint Server	13/5/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
CVE-2025-30382	Analizada	Alta (7.8)	2.5%	—	Microsoft Sharepoint Server	13/5/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
CVE-2025-30378	Analizada	Alta (7)	1.4%	—	Microsoft Sharepoint Server	13/5/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
CVE-2025-29976	Analizada	Alta (7.8)	0.61%	—	Microsoft Sharepoint Server	13/5/2025	17/6/2026	Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
CVE-2025-29794	Analizada	Alta (8.8)	5.1%	—	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	8/4/2025	17/6/2026	Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-29793	Analizada	Alta (7.2)	24%	—	Microsoft Sharepoint Enterprise Server Microsoft Sharepoint Server	8/4/2025	17/6/2026	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.