Class familyMicrosoft · Office
Microsoft Office input validation flaws, 2015–2026
10 Office CVEs with CWE-20 weaknesses, 9 Sep 2015 to 13 Oct 2026. 3 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2015’15
2016’16
2017’17
2018’18
2019’19
2020’20
2021’21
2022’22
4 2023’23
2 2024’24
1 2025’25
2 2026’26
In CISA KEVNot in KEV
20151 CVE, 1 in KEV
20234 CVEs, 1 in KEV
20242 CVEs, 1 in KEV
20251 CVE
20262 CVEs
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2015-2545KEV | 9 Sep 2015 | Microsoft Office Malformed EPS File Vulnerability | Grouped by weakness | 74.5 |
| CVE-2023-23397KEV | 14 Mar 2023 | Microsoft Office Outlook Privilege Escalation Vulnerability | Grouped by weakness | 79.8 |
| CVE-2023-36893 | 8 Aug 2023 | Microsoft Outlook Spoofing Vulnerability | Grouped by weakness | 21.0 |
| CVE-2023-36767 | 12 Sep 2023 | Microsoft Office Security Feature Bypass Vulnerability | Grouped by weakness | 20.6 |
| CVE-2023-35619 | 12 Dec 2023 | Microsoft Outlook for Mac Spoofing Vulnerability | Grouped by weakness | 17.3 |
| CVE-2024-21413KEV | 13 Feb 2024 | Microsoft Outlook Improper Input Validation Vulnerability | Grouped by weakness | 69.8 |
| CVE-2024-38021 | 9 Jul 2024 | Microsoft Outlook Remote Code Execution Vulnerability | Grouped by weakness | 59.0 |
| CVE-2025-47171 | 10 Jun 2025 | Microsoft Outlook Remote Code Execution Vulnerability | Grouped by weakness | 25.1 |
| CVE-2026-69614 | 8 Sep 2026 | Microsoft Office Access Remote Code Execution Vulnerability | Grouped by weakness | 17.9 |
| CVE-2026-105717 | 13 Oct 2026 | Microsoft Office Access Remote Code Execution Vulnerability | Grouped by weakness | 18.0 |