Microsoft Power Bi Report Server vulnerabilities

5 known vulnerabilities affecting microsoft/power_bi_report_server.

Total CVEs

5

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1HIGH1MEDIUM3

Vulnerabilities

Page 1 of 1

CVE-2026-21229HIGHCVSS 8.8fixed in 15.0.1120.113≥ 1.6.0, < 15.0.1120.1132026-02-10

CVE-2026-21229 [HIGH] CWE-20 CVE-2026-21229: Improper input validation in Power BI allows an authorized attacker to execute code over a network. Improper input validation in Power BI allows an authorized attacker to execute code over a network.

CVE-2021-41372CRITICALCVSS 9.6v15.0.1107.1652021-11-10

CVE-2021-41372 [HIGH] CWE-79 CVE-2021-41372: A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power B A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the s

CVE-2021-26859MEDIUMCVSS 6.5v15.0.1103.234v15.0.1104.3002021-03-11

CVE-2021-26859 [HIGH] CVE-2021-26859: Microsoft Power BI Information Disclosure Vulnerability Microsoft Power BI Information Disclosure Vulnerability

CVE-2020-1173MEDIUMCVSS 6.8vunspecified2020-05-21

CVE-2020-1173 [MEDIUM] CWE-20 CVE-2020-1173: A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the cont A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments, aka 'Microsoft Power BI Report Server Spoofing Vulnerability'.

CVE-2019-1332MEDIUMCVSS 6.1vunspecified2019-12-10

CVE-2019-1332 [MEDIUM] CWE-79 CVE-2019-1332: A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'.