CVE-2026-80095

CriticalCVSS 9.0/10Last modified Nov 11, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-800968.8Out-of-bounds read in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.CVE-2026-800978.6Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.CVE-2026-8009810.0Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.CVE-2026-800998.8Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data moduCVE-2026-80106.3Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had comproCVE-2026-801014.4A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width anCVE-2026-801049.8DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_CVE-2026-80114.3Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a CVE-2026-801108.1A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexCVE-2026-801127.8PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an impropCVE-2026-801137.1PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privileCVE-2026-801147.8PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-co
CVE-2026-80095: Critical severity, CVSS 9.0 | Vulnix