CVE-2026-124210

MediumCVSS 6.5/10Last modified Nov 11, 2026

Description

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1242188.2The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file patCVE-2026-1242247.0Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locCVE-2026-1242257.8Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.CVE-2026-1242268.8Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.CVE-2026-1242277.5Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1242288.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to CVE-2026-1242296.6Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.CVE-2026-124237.5A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semCVE-2026-1242336.5Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-124247.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4CVE-2026-1242496.3http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and PCVE-2026-124256.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Cen
CVE-2026-124210: Medium severity, CVSS 6.5 | Vulnix