# Microsoft 365 Apps


- [CVE-2024-21413](https://insights.sbomify.com/CVE-2024-21413/): Microsoft Outlook Improper Input Validation (critical 9.8, exploited in the wild)
- [CVE-2023-23397](https://insights.sbomify.com/CVE-2023-23397/): Microsoft Office Outlook Privilege Escalation (critical 9.8, exploited in the wild)
- [CVE-2024-38189](https://insights.sbomify.com/CVE-2024-38189/): Microsoft Project Remote Code Execution Vulnerability (high 8.8, exploited in the wild)
- [CVE-2023-35311](https://insights.sbomify.com/CVE-2023-35311/): Microsoft Outlook Security Feature Bypass (high 8.8, exploited in the wild)
- [CVE-2026-21514](https://insights.sbomify.com/CVE-2026-21514/): Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision (high 7.8, exploited in the wild)
- [CVE-2026-21509](https://insights.sbomify.com/CVE-2026-21509/): Microsoft Office Security Feature Bypass (high 7.8, exploited in the wild)
- [CVE-2021-42292](https://insights.sbomify.com/CVE-2021-42292/): Microsoft Excel Security Feature Bypass (high 7.8, exploited in the wild)
- [CVE-2021-38646](https://insights.sbomify.com/CVE-2021-38646/): Microsoft Office Access Connectivity Engine Remote Code Execution (high 7.8, exploited in the wild)
- [CVE-2023-21715](https://insights.sbomify.com/CVE-2023-21715/): Microsoft Office Publisher Security Feature Bypass (high 7.3, exploited in the wild)
- [CVE-2023-36761](https://insights.sbomify.com/CVE-2023-36761/): Microsoft Word Information Disclosure (medium 6.5, exploited in the wild)
- [CVE-2026-70242](https://insights.sbomify.com/CVE-2026-70242/): Microsoft Office Outlook Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-70291](https://insights.sbomify.com/CVE-2026-70291/): Microsoft Office Outlook Remote Code Execution Vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/microsoft/365-apps/