CVE-2026-123395

MediumCVSS 5.9/10Last modified Nov 11, 2026

Description

Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-123407.5Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the SubjectCVE-2026-123419.8This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data CVE-2026-1234187.2The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and includCVE-2026-123429.6This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due CVE-2026-123436.5IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queuedCVE-2026-123455.9The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replaceCVE-2026-1234607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-fileCVE-2026-1234615.3Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access ControCVE-2026-1234625.3Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issCVE-2026-1234637.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCCVE-2026-1234646.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events CaleCVE-2026-1234657.5Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Se
CVE-2026-123395: Medium severity, CVSS 5.9 | Vulnix