CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 07:30 UTC)

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,443; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product microsoft:outlook. Show all products

14 CVEs, showing 1 to 14

CVE	Severity	Title	Published
CVE-2007-0671 Known exploited	High 8.8	Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack v… Assigned by microsoft	Feb 3, 2007
CVE-2015-1641 Known exploited	High 7.8	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and… Assigned by microsoft	Apr 14, 2015
CVE-2017-11774 Known exploited	High 7.8	Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outloo… Assigned by microsoft	Oct 13, 2017
CVE-2018-0851	High 8.8	Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a r… Assigned by microsoft	Feb 15, 2018
CVE-2023-23397 Known exploited	Critical 9.8	Microsoft Outlook Elevation of Privilege Vulnerability Assigned by microsoft	Mar 14, 2023
CVE-2023-35311 Known exploited	High 8.8	Microsoft Outlook Security Feature Bypass Vulnerability Assigned by microsoft	Jul 11, 2023
CVE-2026-21260	High 7.5	Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.	Feb 10, 2026
CVE-2026-26133	High 7.1	AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.	Mar 16, 2026
CVE-2026-42893	High 7.5	Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.	May 12, 2026
CVE-2026-70329	High 8.8	Microsoft Outlook Remote Code Execution Vulnerability Assigned by microsoft	Aug 11, 2026
CVE-2026-62882	Medium 4.3	Microsoft Outlook Spoofing Vulnerability Assigned by microsoft	Aug 11, 2026
CVE-2026-69629	High 8.8	Microsoft Office Outlook Remote Code Execution Vulnerability Assigned by microsoft	Sep 8, 2026
CVE-2026-78519	High 8.8	Microsoft Office Outlook Remote Code Execution Vulnerability Assigned by microsoft	Sep 8, 2026
CVE-2026-80073	Medium 6.5	Microsoft Office Outlook Information Disclosure Vulnerability Assigned by microsoft	Sep 8, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.