Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

11 records in Power Bi Report Server · all components

TI-2026-46897 CVE-2026-65811 · GHSA-jxpp-q6w9-f47h

Power BI Remote Code Execution Vulnerability

Priority MEDIUM 42

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00958 Published 2026-08-11 Fixed in 1.26.9682.1442 CWE-20
TI-2026-17140 CVE-2026-21229 · GHSA-9h3x-5px3-gfh7

Power BI Remote Code Execution Vulnerability

Priority MEDIUM 42

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0095 Published 2026-02-10 Fixed in 1.25.9508.3237 CWE-20
TI-2024-29123 CVE-2024-43481 · GHSA-p7pp-ghq2-q7cc

Power BI Report Server Spoofing Vulnerability

Priority MEDIUM 42

Power BI Report Server Spoofing Vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01816 Published 2024-10-08 Fixed in 1.21.9032.4573 CWE-79
TI-2021-18191 CVE-2021-41372 · GHSA-3w9m-7j3j-w9p6

Power BI Report Server Spoofing Vulnerability

Priority MEDIUM 42

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directl…

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00682 Published 2021-11-10 Fixed in 1.11.8091.10468, 1.12.7977.29537 CWE-352
TI-2019-01046 CVE-2019-1332 · GHSA-hh72-g9hv-8pq3

Cross-site scripting in Microsoft SQL Server 2017 Reporting Services

Priority MEDIUM 40

A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Repor…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.10867 Published 2019-12-10 No fix listed CWE-79
TI-2026-42213 CVE-2026-58647 · GHSA-qxvr-2hqj-cxr6

Microsoft PowerBI Report Server Spoofing Vulnerability

Priority LOW 37

Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00523 Published 2026-07-14 Fixed in 1.26.9682.1442 CWE-79
TI-2023-08187 CVE-2023-21806 · GHSA-6597-448m-8mxp

Power BI Report Server Spoofing Vulnerability

Priority LOW 37

Power BI Report Server Spoofing Vulnerability

CVSS 3.1HIGH 8.2 Network Low privileges User interaction EPSS 0.00775 Published 2023-02-14 Fixed in 1.16.8420.13742 CWE-79
TI-2020-01137 CVE-2020-1173 · GHSA-42v9-rj5j-m2v5

Microsoft Power BI Report Server Spoofing Vulnerability

Priority LOW 35

A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.02482 Published 2020-05-21 Fixed in 1.6.7364.4075 CWE-20
TI-2024-29238 CVE-2024-43612 · GHSA-gm85-m2qv-27w7

Power BI Report Server Spoofing Vulnerability

Priority LOW 32

Power BI Report Server Spoofing Vulnerability

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.00722 Published 2024-10-08 Fixed in 1.21.9032.4573 CWE-79
Open these records in search →