CVE-2016-7244
Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Micros
CVSS
5.5
Medium
EPSS
16.5%
p97
KEV
—
Exploit Today
29
0-100
Published: Nov 10, 2016 · Last modified: Oct 15, 2026 · CWE-284
16.5%EPSS · 30 days16.5%
2026-10-142026-11-11
Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Microsoft Office Denial of Service Vulnerability."
- www.securityfocus.comhttp://www.securityfocus.com/bid/94029
- www.securitytracker.comhttp://www.securitytracker.com/id/1037246
- docs.microsoft.comhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-133
- www.securityfocus.comhttp://www.securityfocus.com/bid/94029
- www.securitytracker.comhttp://www.securitytracker.com/id/1037246
- docs.microsoft.comhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-133
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-126332——
———Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.10hCVE-2026-126326——
———Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.10hCVE-2026-760803.7 LOW—
———Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.13hCVE-2026-888135.3 MED5.4%
——2The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid.20hCVE-2026-1218735.3 MED6.3%
——2The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied through its data request form action and by default records the resulting request as already confirmed, allowing unauthenticated visitors to create verified WordPress personal data erasure or export requests for addresses they do not control.20hCVE-2026-1175234.3 MED7.7%
——2The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide.20h