Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

Microsoft OneNote

Source -

CNA

CNA CVEs -

3

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

0
Related CVEsRelated VendorsRelated AssignersReports
3Vulnerabilities found
CVE-2026-26133
Assigner-Microsoft Corporation
ShareView Details
Assigner-Microsoft Corporation
CVSS Score-7.1||HIGH
EPSS-0.43% / 35.37%
||
7 Day CHG~0.00%
Published-13 Mar, 2026 | 21:10
Updated-19 Jun, 2026 | 18:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
M365 Copilot Information Disclosure Vulnerability

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Action-Not Available
Vendor-Microsoft Corporation
Product-365_copilotpower_biexcelloopteamswordpowerpointedgeoutlookonenoteMicrosoft Outlook for AndroidMicrosoft PowerBI for AndroidMicrosoft OneNoteMicrosoft Teams for AndroidMicrosoft PowerBI for iOSMicrosoft Teams for iOSMicrosoft Outlook for MacMicrosoft PowerPoint for AndroidMicrosoft Word for iOSMicrosoft OneNote for AndroidMicrosoft 365 Copilot for iOSMicrosoft Excel for AndroidMicrosoft 365 Copilot for AndroidMicrosoft Word for AndroidMicrosoft Outlook for iOSMicrosoft Excel for iOSMicrosoft Loop for iOSMicrosoft Edge for iOSMicrosoft PowerPoint for iOSMicrosoft Edge for Android
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-29822
Assigner-Microsoft Corporation
ShareView Details
Assigner-Microsoft Corporation
CVSS Score-7.8||HIGH
EPSS-0.78% / 52.24%
||
7 Day CHG~0.00%
Published-08 Apr, 2025 | 17:23
Updated-13 Feb, 2026 | 19:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Microsoft OneNote Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Microsoft Office OneNote allows an unauthorized attacker to bypass a security feature locally.

Action-Not Available
Vendor-Microsoft Corporation
Product-officeonenoteoffice_long_term_servicing_channelMicrosoft OneNote 2016Microsoft 365 Apps for EnterpriseMicrosoft Office LTSC for Mac 2021Microsoft Office LTSC for Mac 2024Microsoft OneNoteMicrosoft Office LTSC 2021Microsoft Office 2019Microsoft Office LTSC 2024
CWE ID-CWE-184
Incomplete List of Disallowed Inputs
CVE-2025-21402
Assigner-Microsoft Corporation
ShareView Details
Assigner-Microsoft Corporation
CVSS Score-7.8||HIGH
EPSS-0.65% / 47.40%
||
7 Day CHG~0.00%
Published-14 Jan, 2025 | 18:04
Updated-09 Jun, 2026 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Microsoft Office OneNote Remote Code Execution Vulnerability

Microsoft Office OneNote Remote Code Execution Vulnerability

Action-Not Available
Vendor-Microsoft Corporation
Product-onenoteoffice_long_term_servicing_channelofficeMicrosoft Office LTSC for Mac 2021Microsoft OneNoteMicrosoft Office LTSC for Mac 2024
CWE ID-CWE-641
Improper Restriction of Names for Files and Other Resources