https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 18:14:10 +0000 https://vulnerability.circl.lu/vuln/cve-2026-106155 <p><strong>Affected:</strong> Progress Software Telerik Report Server</p> <p>In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer&#39;s origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user&#39;s authenticated session, including an administrator&#39;s session.</p> <p><strong>Affected:</strong> Progress Software Telerik Report Server</p> <p>In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer&#39;s origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user&#39;s authenticated session, including an administrator&#39;s session.</p> https://vulnerability.circl.lu/vuln/cve-2026-106155