8.0
High
CVE-2026-58647 Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized…
Description
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Power BI Report Server 1.6 | 1.6.0 → < 1.26.9682.1442 | 1.26.9682.1442 |
Other CVEs of Power BI Report Server
The 5 CVEs of Power BI Report Server →
CVE-2026-65811
Improper input validation in Power BI allows an authorized attacker to execute code over a network
8.8
High
CVE-2026-21229
Improper input validation in Power BI allows an authorized attacker to execute code over a network
8.0
High
CVE-2020-1173
A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded…
Not rated
CVE-2019-1332
A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not…
Not rated