CVE-2026-106155

{
  "etk_id": "ETK-2026-1056",
  "cve_id": "CVE-2026-106155",
  "display_id": "CVE-2026-106155",
  "ghsa_id": "GHSA-97qc-r4xh-88c5",
  "euvd_id": "EUVD-2026-95524",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Telerik Report Server",
  "summary": "Telerik Report Server versions before 12.2.26.1007 are affected by stored cross-site scripting in report content. An authenticated report author can cause script to run in another user's web report viewer session when that user views and triggers the crafted report content, potentially allowing actions with the viewer's privileges.",
  "mitigation": "Upgrade Telerik Report Server to version 12.2.26.1007 or later. Until upgrade is complete, restrict report-authoring access to trusted users and limit access to reports from untrusted authors.",
  "vendor": "Progress Software",
  "product": "Telerik Report Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 12.2.26.1007"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "12.2.26.1007"
      ],
      "package_name": "Telerik Report Server",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
  "epss_score": 0.002,
  "epss_percentile": 0.0918,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 35.882884516666664,
  "t0_at": "2026-10-09T07:07:57.817000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-11T11:45:29.727498+00:00",
      "days": 2.192730445578704,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T07:07:57.817000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-09T07:07:57.817000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T07:07:57.817000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106155"
    }
  }
}