Filtered by vendor Microsoft Subscriptions
Filtered by product Outlook Subscriptions
Total 122 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2000-0756 1 Microsoft 1 Outlook 2026-04-16 N/A
Microsoft Outlook 2000 does not properly process long or malformed fields in vCard (.vcf) files, which allows attackers to cause a denial of service.
CVE-2002-0481 1 Microsoft 1 Outlook 2026-04-16 N/A
An interaction between Windows Media Player (WMP) and Outlook 2002 allows remote attackers to bypass Outlook security settings and execute Javascript via an IFRAME in an HTML email message that references .WMS (Windows Media Skin) or other WMP media files, whose onload handlers execute the player.LaunchURL() Javascript function.
CVE-2000-0160 1 Microsoft 3 Ie, Internet Explorer, Outlook 2026-04-16 N/A
The Microsoft Active Setup ActiveX component in Internet Explorer 4.x and 5.x allows a remote attacker to install software components without prompting the user by stating that the software's manufacturer is Microsoft.
CVE-2002-1255 1 Microsoft 1 Outlook 2026-04-16 N/A
Microsoft Outlook 2002 allows remote attackers to cause a denial of service (repeated failure) via an email message with a certain invalid header field that is accessed using POP3, IMAP, or WebDAV, aka "E-mail Header Processing Flaw Could Cause Outlook 2002 to Fail."
CVE-2006-0002 1 Microsoft 3 Exchange Server, Office, Outlook 2026-04-16 N/A
Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.
CVE-2002-1696 2 Microsoft, Pgp 2 Outlook, Personal Privacy 2026-04-16 5.5 Medium
Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Always use Secure Viewer when decrypting" option is not checked, and the user replies to an encrypted message.
CVE-2004-0204 4 Bea, Borland Software, Businessobjects and 1 more 9 Weblogic Server, J Builder, Crystal Enterprise and 6 more 2026-04-16 N/A
Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
CVE-2006-4868 1 Microsoft 5 Internet Explorer, Outlook, Windows 2000 and 2 more 2026-04-16 N/A
Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag.
CVE-1999-0519 1 Microsoft 4 Outlook, Windows 2000, Windows 95 and 1 more 2026-04-16 N/A
A NETBIOS/SMB share password is the default, null, or missing.
CVE-2002-2101 1 Microsoft 1 Outlook 2026-04-16 N/A
Microsoft Outlook 2002 allows remote attackers to execute arbitrary JavaScript code, even when scripting is disabled, via an "about:" or "javascript:" URI in the href attribute of an "a" tag.
CVE-2003-1378 1 Microsoft 2 Outlook, Outlook Express 2026-04-16 N/A
Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.
CVE-2004-0526 1 Microsoft 4 Ie, Internet Explorer, Outlook and 1 more 2026-04-16 N/A
Unknown versions of Internet Explorer and Outlook allow remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack.
CVE-2004-0501 1 Microsoft 1 Outlook 2026-04-16 N/A
Outlook 2003 allows remote attackers to bypass intended access restrictions and cause Outlook to request a URL from a remote site via an HTML e-mail message containing a Vector Markup Language (VML) entity whose src parameter points to the remote site, which could allow remote attackers to know when a message has been read, verify valid e-mail addresses, and possibly leak other information.
CVE-2026-21260 1 Microsoft 11 365 Apps, Office, Office 2019 and 8 more 2026-04-15 7.5 High
Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-26133 1 Microsoft 35 365 Copilot, 365 Copilot Android, 365 Copilot For Android and 32 more 2026-04-14 7.1 High
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-21357 1 Microsoft 8 365 Apps, Office, Office 2019 and 5 more 2026-02-26 6.7 Medium
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2025-49699 1 Microsoft 14 365 Apps, Office, Office 2019 and 11 more 2026-02-26 7 High
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-47171 1 Microsoft 9 365 Apps, Office, Office 2019 and 6 more 2026-02-26 6.7 Medium
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2025-47176 1 Microsoft 5 365 Apps, Office, Office 2024 and 2 more 2026-02-26 7.8 High
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2020-1493 1 Microsoft 3 365 Apps, Office, Outlook 2026-02-23 5.5 Medium
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting. The security update addresses the vulnerability by correcting how Outlook handles file attachment links.