Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-106133

Incorrect Authorization in Telerik Report Server Web Report Designer

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Telerik Report Server Telerik Report Server
CVE-2026-106152

External Control of Configuration Setting in Telerik Report Server

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Telerik Report Server Telerik Report Server
CVE-2026-106145

Privilege Escalation in Telerik Report Server Service-Agent Hub

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server
CVE-2025-0556

Telerik Report Server Clear Text Transmission of Agent Commands

In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server
CVE-2024-1800

Progress Telerik Report Server Deserialization

In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.

CVSS 3.1 · 9.9 Critical EPSS 34.2% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server
CVE-2024-4837

Trust Boundary Violation Vulnerability

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server
CVE-2024-6327

Progress Telerik Report Server Deserialization

In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.

CVSS 3.1 · 9.9 Critical EPSS 2.0% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server
CVE-2024-7295

Hard-coded credentials used for temporary and cache data encryption

In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server
CVE-2024-7294

Uncontrolled resource consumption of anonymous endpoints

In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server Telerik Reporting
CVE-2024-7293

Password policy for new users is not strong enough

In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Report Server Telerik Reporting