Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-106133

Incorrect Authorization in Telerik Report Server Web Report Designer

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Telerik Report Server Telerik Report Server
CVE-2026-106152

External Control of Configuration Setting in Telerik Report Server

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Telerik Report Server Telerik Report Server
CVE-2026-106155

Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.

CVSS 3.1 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Progress Software
Products
Telerik Report Server
CVE-2024-4358

Registration Authentication Bypass Vulnerability

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 97.5% KEV · Listed
Vendors
Progress Software Telerik
Products
Telerik Report Server Report Server 2024