Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Oct 9, 2026In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authentiCVE-2026-106155 · Other software · Progress Software · reported by security@progress.comHigh 8.9
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user,CVE-2026-106145 · Other software · Progress Software · reported by security@progress.comHigh 7.1
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Improper input validation in Power BI allows an authorized attacker to execute code over a network.CVE-2026-65811 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
- Product
- Power BI Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a networCVE-2026-58647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.
- Product
- Power BI Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Improper input validation in Power BI allows an authorized attacker to execute code over a network.CVE-2026-21229 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Improper input validation in Power BI allows an authorized attacker to execute code over a network.
- Product
- Power BI Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive CVE-2025-0556 · Other software · Progress Software · reported by security@progress.comHigh 8.8
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophiCVE-2024-7295 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.1
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure tCVE-2024-8015 · Other software · Progress Software · reported by security@progress.comCritical 9.1
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- Product
- Telerik Reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.CVE-2024-7294 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.5
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.CVE-2024-7293 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.5
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive CVE-2024-7292 · Other software · Progress Software Corporation · reported by security@progress.comHigh 7.5
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Power BI Report Server Spoofing VulnerabilityCVE-2024-43612 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.9
Power BI Report Server Spoofing Vulnerability
- Product
- Power BI Report Server - May 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Power BI Report Server Spoofing VulnerabilityCVE-2024-43481 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Power BI Report Server Spoofing Vulnerability
- Product
- Power BI Report Server - May 2024
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnCVE-2024-6327 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.9
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.telerik.comtelerik.com
Jul 10, 2024Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0.CVE-2024-3325 · Other software · Jaspersoft · reported by security@tibco.comHigh 8.6
Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0.
- Product
- JasperReport Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.jaspersoft.comcommunity.jaspersoft.com
May 29, 2024Progress Telerik Report Server Authentication Bypass by Spoofing VulnerabilityCVE-2024-4358 · Other software · Progress · reported by security@progress.comExploitedCritical 9.8
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
- Product
- Telerik Report Server
- On CISA’s list since
- Jun 13, 2024 (federal fix deadline Jul 4, 2024)
- What to do
- Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdocs.telerik.comdocs.telerik.com
May 15, 2024In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restriCVE-2024-4837 · Other software · Progress Software · reported by security@progress.comMedium 5.3
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.telerik.comdocs.telerik.com
May 15, 2024An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to reaCVE-2024-4357 · Other software · Progress Software · reported by security@progress.comMedium 6.5
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.telerik.comdocs.telerik.com
Mar 20, 2024 In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulCVE-2024-1800 · Other software · Progress Software Corporation · reported by security@progress.comCritical 9.9
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.
- Product
- Telerik Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.telerik.comtelerik.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46902 · Other software · Vocera · reported by MITREHigh 7.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is a Path Traversal for an Unzip operation. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. During the unzip operation, the code takes file paths from the ZIP archive and writes them to a Vocera temporary directory. Unfortunately, the code does not properly check if the file paths include directory traversal payloads that would escape the intended destination.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46901 · Other software · Vocera · reported by MITREHigh 7.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This includes system tasks, and backing up, loading, and clearing of the database.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46900 · Other software · Vocera · reported by MITREMedium 6.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal in the Task Exec filename. The Vocera Report Console contains various jobs that are executed on the server at specified intervals, e.g., backup, etc. An authenticated user has the ability to modify these entries and set the executable path and parameters.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46899 · Other software · Vocera · reported by MITREHigh 7.5
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Arbitrary File Upload. The BaseController class, that each of the service controllers derives from, allows for the upload of arbitrary files. If the HTTP request is a multipart/form-data POST request, any parameters with a filename entry will have their content written to a file in the Vocera upload-staging directory with the specified filename in the parameter.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Jul 25, 2023An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.CVE-2022-46898 · Other software · Vocera · reported by MITRECritical 9.8
An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal via the "restore SQL data" filename. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. The filename provided is not properly sanitized and allows for the inclusion of a path-traversal payload that can be used to escape the intended Vocera restoration directory. An attacker could exploit this vulnerability to point to a crafted ZIP archive that contains SQL commands that could be executed against the database.
- Product
- Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordstryker.comstryker.com
Feb 14, 2023Power BI Report Server Spoofing VulnerabilityCVE-2023-21806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.2
Power BI Report Server Spoofing Vulnerability
- Product
- Power BI Report Server - January 2023
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 9, 2021A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files iCVE-2021-41372 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.6
A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded. The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.
- Product
- Power BI Report Server version 1.11.8091.10468
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021Microsoft Power BI Information Disclosure VulnerabilityCVE-2021-26859 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.7
Microsoft Power BI Information Disclosure Vulnerability
- Product
- Power BI Report Server version 15.0.1103.234
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 21, 2020A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments.CVE-2020-1173 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. The attacker who successfully exploited this vulnerability could then perform actions and run scripts in the security context of the user. This security update addresses the vulnerability by ensuring Power BI Report Server properly validates content-type of the attachments when uploading and opening.
- Product
- Power BI Report Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 18, 2018Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Report Server Config).CVE-2018-3013 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Report Server Config). The supported version that is affected is 5.5.x. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Hospitality OPERA 5 Property Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Feb 28, 2018IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server accesCVE-2016-0291 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302.
- Product
- Bigfix Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comexchange.xforce.ibmcloud.com
Dec 13, 2011Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via CVE-2011-4805 · Network & remote access · SAP · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via the service parameter.
- Product
- Crystal Reports Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.