Microsoft Power Bi Report Server — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Power Bi Report Server, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (11)

• CVE-2026-65811 — CVSS 8.8 (high): Improper input validation in Power BI allows an authorized attacker to execute code over a network.
• CVE-2023-21806 — CVSS 8.2 (high): Power BI Report Server Spoofing Vulnerability
• CVE-2026-21229 — CVSS 8.0 (high): Improper input validation in Power BI allows an authorized attacker to execute code over a network.
• CVE-2026-58647 — CVSS 8.0 (high): Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform…
• CVE-2021-26859 — CVSS 7.7 (high): Microsoft Power BI Information Disclosure Vulnerability
• CVE-2021-31984 — CVSS 7.6 (high): Power BI Remote Code Execution Vulnerability
• CVE-2021-41372 — CVSS 7.6 (high): A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix)…
• CVE-2024-43612 — CVSS 6.9 (medium): Power BI Report Server Spoofing Vulnerability
• CVE-2020-1173 — CVSS 6.8 (medium): A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An…
• CVE-2024-43481 — CVSS 6.5 (medium): Power BI Report Server Spoofing Vulnerability
• CVE-2019-1332 — CVSS 6.1 (medium): A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a…