CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Office Word Security Feature Bypass Vulnerability (CVE-2026-21514) Analysis and Mitigation Guide
[Affected Scope] Microsoft Office Word and associated Office suites
[Impact] Unauthorized local attackers can bypass critical security controls, such as Protected View or macro execution blocks, to execute arbitrary code
[Mitigation] Apply the official Microsoft security updates immediately and restrict execution of untrusted document files (.docx, .docm)
Microsoft Office Security Feature Bypass Vulnerability (CVE-2026-21509) Analysis and Mitigation Guide
[Affected Scope] All Microsoft Office suites and local environments processing untrusted document inputs.
[Impact] Attackers can bypass local security decisions, leading to unauthorized macro execution and arbitrary code execution.
[Mitigation] Apply official Microsoft security patches immediately and enforce strict macro blocking policies for untrusted files.
Microsoft Publisher Security Feature Bypass Vulnerability (CVE-2024-38226) Technical Advisory
[Affected Scope] Microsoft Publisher 2016, Office LTSC 2021, and Microsoft 365 Apps within supported lifecycles
[Impact] An attacker can bypass Office macro block policies and Mark of the Web (MOTW) security warnings to execute arbitrary code when a user opens a specially crafted Publisher file
[Mitigation] Apply the official Microsoft security updates immediately and enforce Group Policies to block macros in files originating from the Internet
Microsoft Project Remote Code Execution Vulnerability Advisory (CVE-2024-38189, CISA KEV Listed)
[Affected Scope] Microsoft Project 2016, LTSC Professional Plus 2021, and Microsoft 365 Apps for Enterprise
[Impact] Successful exploitation allows an attacker to execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted Project (.mpp) file
[Mitigation] Apply the official Microsoft security updates immediately and enforce strict policies to block untrusted macro and external content execution
Microsoft Word Information Disclosure and NTLM Hash Leakage Vulnerability (CVE-2023-36761) Technical Analysis & Mitigation Guide
[Affected Scope] Broad range of Microsoft Office products including Microsoft Word 2013, 2016, 2019, 2021, and Microsoft 365 Apps
[Impact] Attackers can force the victim's system to leak NTLM credentials (hashes) to an external malicious server simply by having the victim select or preview a crafted document in the Preview Pane
[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB (TCP 445) traffic at the perimeter, and restrict outbound NTLM authentication via Group Policy
Windows Search Remote Code Execution Vulnerability (CVE-2023-36884) Security Advisory & Mitigation Guide
[Affected Scope] All endpoint systems running Microsoft Windows and Microsoft Office suites
[Impact] Remote attackers can execute arbitrary code with system privileges via specially crafted documents, leading to full system compromise
[Mitigation] Apply the official Microsoft cumulative security updates immediately, or implement the registry-based workaround
Microsoft Outlook Security Feature Bypass Vulnerability (CVE-2023-35311) Security Advisory
[Affected Scope] Broad range of Microsoft Office products including Microsoft Outlook 2013, 2016, 2019, 2021, and Microsoft 365 Apps for Enterprise
[Impact] Attackers can bypass Outlook security warning prompts via specially crafted links, potentially leading to subsequent Remote Code Execution (RCE)
[Mitigation] Immediately apply the official Microsoft security patches and restrict untrusted link execution via Group Policy (GPO) or registry hardening
Microsoft Outlook Remote NTLM Credential Theft & Elevation of Privilege Vulnerability (CVE-2023-23397) Critical Security Advisory
[Affected Scope] All supported desktop versions of Microsoft Outlook for Windows, including Outlook 2013, 2016, LTSC 2021, and Microsoft 365 Apps
[Impact] Attackers can trigger the vulnerability silently without user interaction (Zero-Click) simply by sending a malicious email, leaking the user's NTLM hash to external servers for NTLM relay attacks
[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB traffic (TCP port 445) at the perimeter, and run the Exchange audit script to purge malicious items
Microsoft Publisher Security Feature Bypass and Remote Code Execution Vulnerability (CVE-2023-21715) Analysis & Mitigation Guide
[Affected Scope] Microsoft Office and Microsoft Publisher 2013, 2016, 2019, 2021, and Microsoft 365 Apps
[Impact] Attackers can bypass Office macro blocking policies (Mark of the Web) via specially crafted Publisher files to execute arbitrary code
[Mitigation] Apply official Microsoft security patches immediately and enforce registry policies to disable Publisher macros
Microsoft Office and VBA VBE6.dll Untrusted Search Path Vulnerability (CVE-2012-1854) Advisory
[Affected Scope] Microsoft Office 2003 SP3, 2007 SP2/SP3, 2010 Gold/SP1, and systems utilizing Visual Basic for Applications (VBA)
[Impact] Local attackers can execute arbitrary code and escalate privileges by tricking a user into opening a document in a directory containing a malicious DLL
[Mitigation] Apply the official Microsoft security update (MS12-046) and restrict insecure DLL loading via registry modifications
Microsoft Excel Remote Code Execution (RCE) Zero-Day Vulnerability (CVE-2007-0671)
[Affected Scope] Microsoft Excel 2000, XP, 2003, Excel 2004 for Mac, and potentially other legacy Office products
[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a specially crafted Excel file
[Mitigation] Apply official Microsoft security patches immediately, restrict opening untrusted Excel attachments, and enforce strict macro execution policies