Known vulnerabilities in Power BI Report Server

Vendor: Microsoft
Software: Power BI Report Server
Software CPE: cpe:2.3:a:microsoft:power_bi_report_server:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 9
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Power BI Report Server Power BI Report Server is affected by 9 known vulnerabilities: 6 medium, 3 low Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138294 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-58647		 CWE-79 Low
No
No
 15.0.1121.120 17.07.2026 SB2026071746
#VU122561 - Improper input validation
CVE-2026-21229		 CWE-20 Medium
No
No
 15.0.1120.113 10.02.2026 SB2026021071
#VU98259 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-43481		 CWE-79 Low
No
No
 15.0.1116.121 09.10.2024 SB2024100922
#VU98258 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-43612		 CWE-79 Low
No
No
 15.0.1116.121 09.10.2024 SB2024100922
#VU72225 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2023-21806		 CWE-451 Medium
No
No
 15.0.1111.115 15.02.2023 SB2023021509
#VU58063 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2021-41372		 CWE-451 Medium
No
No
 - 09.11.2021 SB2021110935
#VU54824 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-31984		 CWE-94 Medium
No
No
 - 13.07.2021 SB2021071375
#VU51343 - Exposure of sensitive information to an unauthorized actor
CVE-2021-26859		 CWE-200 Medium
No
No
 - 09.03.2021 SB2021030949
#VU27828 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2020-1173		 CWE-451 Medium
No
No
 - 12.05.2020 SB2020051245