# cve.now: Progress Software

The newest entries naming Progress Software as an affected vendor (up to 200), of 285 in all, 6 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115340](https://cve.now/CVE-2026-115340.md): Insecure Storage of Web Transfer Credentials in Progress WS\_FTP Server (CVSS 7.1)
- [CVE-2026-115339](https://cve.now/CVE-2026-115339.md): Unauthenticated XFT Memory Exhaustion in Progress WS\_FTP Server (CVSS 7.5)
- [CVE-2026-115341](https://cve.now/CVE-2026-115341.md): Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS\_FTP Server (CVSS 7.7)
- [CVE-2026-115337](https://cve.now/CVE-2026-115337.md): Folder Permission Bypass in Progress WS\_FTP Server (CVSS 6.3)
- [CVE-2026-115336](https://cve.now/CVE-2026-115336.md): FTP Quota Accounting Bypass in Progress WS\_FTP Server (CVSS 6.5)
- [CVE-2026-115338](https://cve.now/CVE-2026-115338.md): Insecure XFT Transport in Progress WS\_FTP Server (CVSS 8.1)
- [CVE-2026-106128](https://cve.now/CVE-2026-106128.md): Prototype Pollution in Progress Software Kendo UI for Vue (CVSS 4.1)
- [CVE-2026-106127](https://cve.now/CVE-2026-106127.md): Prototype Pollution in Progress Software KendoReact (CVSS 4.1)
- [CVE-2026-106144](https://cve.now/CVE-2026-106144.md): Prototype Pollution in Progress Software Kendo UI for Angular (CVSS 4.1)
- [CVE-2026-106143](https://cve.now/CVE-2026-106143.md): Cross-Site Scripting in Progress Software Kendo UI for Vue (CVSS 5.4)
- [CVE-2026-106142](https://cve.now/CVE-2026-106142.md): Cross-Site Scripting in Progress Software KendoReact (CVSS 5.4)
- [CVE-2026-106141](https://cve.now/CVE-2026-106141.md): Cross-Site Scripting in Progress Software Kendo UI for Angular (CVSS 5.4)
- [CVE-2026-106136](https://cve.now/CVE-2026-106136.md): Cross-Site Scripting in Progress Software KendoReact (CVSS 5.4)
- [CVE-2026-106134](https://cve.now/CVE-2026-106134.md): Cross-Site Scripting in Progress Software KendoReact (CVSS 5.4)
- [CVE-2026-106135](https://cve.now/CVE-2026-106135.md): Cross-Site Scripting in Progress Software Kendo UI for Angular (CVSS 5.4)
- [CVE-2026-104656](https://cve.now/CVE-2026-104656.md): Cross-site Scripting in Progress Telerik Fiddler Everywhere (CVSS 7.3)
- [CVE-2026-104657](https://cve.now/CVE-2026-104657.md): Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill (CVSS 7.5)
- [CVE-2026-90872](https://cve.now/CVE-2026-90872.md): Server-Side Script Injection in Manager Web UI in Progress WS\_FTP Server (CVSS 6.6)
- [CVE-2026-90871](https://cve.now/CVE-2026-90871.md): Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS\_FTP Server (CVSS 5.3)
- [CVE-2026-90870](https://cve.now/CVE-2026-90870.md): Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS\_FTP Server (CVSS 5.3)
- [CVE-2026-90869](https://cve.now/CVE-2026-90869.md): Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS\_FTP Server (CVSS 7.5)
- [CVE-2026-90868](https://cve.now/CVE-2026-90868.md): OS Command Injection in Progress WS\_FTP Server (CVSS 9.9)
- [CVE-2026-90867](https://cve.now/CVE-2026-90867.md): Improper Access Control of Web Admin Console in Progress WS\_FTP Server (CVSS 8.1)
- [CVE-2026-90866](https://cve.now/CVE-2026-90866.md): Virtual Folder Path Confinement Bypass in Progress WS\_FTP Server (CVSS 9.1)
- [CVE-2026-90865](https://cve.now/CVE-2026-90865.md): Command Injection via FTP Notification Variables in Progress WS\_FTP Server (CVSS 9.0)
- [CVE-2026-90864](https://cve.now/CVE-2026-90864.md): Host Administrator Path Containment Bypass in Progress WS\_FTP Server (CVSS 9.1)
- [CVE-2026-90863](https://cve.now/CVE-2026-90863.md): Privilege Escalation via Missing Authorization in WS\_FTP Manager (CVSS 9.1)
- [CVE-2026-90862](https://cve.now/CVE-2026-90862.md): Web Transfer Module Multi-Factor Authentication Bypass in Progress WS\_FTP Server (CVSS 4.3)
- [CVE-2026-90861](https://cve.now/CVE-2026-90861.md): Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS\_FTP Server (CVSS 6.6)
- [CVE-2026-84296](https://cve.now/CVE-2026-84296.md): SSH Multi-Factor Authentication Bypass in Progress WS\_FTP Server (CVSS 6.8)
- [CVE-2026-84295](https://cve.now/CVE-2026-84295.md): Improper Authentication in Progress WS\_FTP Server (CVSS 10.0)
- [CVE-2026-84294](https://cve.now/CVE-2026-84294.md): Information Disclosure in Ad Hoc Transfer in Progress WS\_FTP Server (CVSS 7.7)
- [CVE-2026-118037](https://cve.now/CVE-2026-118037.md): Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing (CVSS 7.5)
- [CVE-2026-118036](https://cve.now/CVE-2026-118036.md): Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question… (CVSS 7.5)
- [CVE-2026-118035](https://cve.now/CVE-2026-118035.md): Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing (CVSS 7.5)
- [CVE-2026-118040](https://cve.now/CVE-2026-118040.md): Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing (CVSS 7.5)
- [CVE-2026-118039](https://cve.now/CVE-2026-118039.md): XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing (CVSS 7.5)
- [CVE-2026-118038](https://cve.now/CVE-2026-118038.md): Path Traversal in Telerik Document Processing Libraries AI Agent Tools (CVSS 7.1)
- [CVE-2026-108116](https://cve.now/CVE-2026-108116.md): MDX and SOAP Injection in Kendo UI for jQuery (CVSS 7.5)
- [CVE-2026-106153](https://cve.now/CVE-2026-106153.md): Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar (CVSS 5.4)
- [CVE-2026-106151](https://cve.now/CVE-2026-106151.md): Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery (CVSS 5.4)
- [CVE-2026-106150](https://cve.now/CVE-2026-106150.md): Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip (CVSS 5.4)
- [CVE-2026-106149](https://cve.now/CVE-2026-106149.md): Cross-site Scripting (XSS) in Kendo UI for jQuery Menu (CVSS 5.4)
- [CVE-2026-106148](https://cve.now/CVE-2026-106148.md): Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery (CVSS 5.4)
- [CVE-2026-106147](https://cve.now/CVE-2026-106147.md): Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery (CVSS 5.4)
- [CVE-2026-106161](https://cve.now/CVE-2026-106161.md): Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery (CVSS 5.4)
- [CVE-2026-106160](https://cve.now/CVE-2026-106160.md): Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery (CVSS 5.4)
- [CVE-2026-106159](https://cve.now/CVE-2026-106159.md): Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery (CVSS 4.7)
- [CVE-2026-106158](https://cve.now/CVE-2026-106158.md): Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery (CVSS 4.7)
- [CVE-2026-106157](https://cve.now/CVE-2026-106157.md): Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery (CVSS 4.7)
- [CVE-2026-106162](https://cve.now/CVE-2026-106162.md): Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery (CVSS 4.7)
- [CVE-2026-106163](https://cve.now/CVE-2026-106163.md): Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser (CVSS 6.5)
- [CVE-2026-85976](https://cve.now/CVE-2026-85976.md): HTTP response splitting in Progress MarkLogic Server Query Console (CVSS 5.4)
- [CVE-2026-85975](https://cve.now/CVE-2026-85975.md): Cleartext transmission in Progress MarkLogic Server Amazon S3 connections (CVSS 7.5)
- [CVE-2026-85974](https://cve.now/CVE-2026-85974.md): Improper TLS hostname verification in Progress MarkLogic Server (CVSS 7.4)
- [CVE-2026-85973](https://cve.now/CVE-2026-85973.md): Cleartext transmission in Progress MarkLogic Server cluster join operations (CVSS 7.4)
- [CVE-2026-85972](https://cve.now/CVE-2026-85972.md): Improper Kerberos server verification in Progress MarkLogic Server (CVSS 7.4)
- [CVE-2026-85971](https://cve.now/CVE-2026-85971.md): Incorrect log file permissions in Progress MarkLogic Server (CVSS 7.1)
- [CVE-2026-85970](https://cve.now/CVE-2026-85970.md): Improper XML external entity restriction in Progress MarkLogic Server (CVSS 7.1)
- [CVE-2026-85969](https://cve.now/CVE-2026-85969.md): Out-of-bounds write in Progress MarkLogic Server (CVSS 7.1)
- [CVE-2026-85968](https://cve.now/CVE-2026-85968.md): Out-of-bounds read in Progress MarkLogic Server (CVSS 7.1)
- [CVE-2026-85967](https://cve.now/CVE-2026-85967.md): Cross-site scripting in Progress MarkLogic Server (CVSS 6.1)
- [CVE-2026-85966](https://cve.now/CVE-2026-85966.md): Exposure of sensitive information in Progress MarkLogic Server (CVSS 7.7)
- [CVE-2026-85965](https://cve.now/CVE-2026-85965.md): Use-after-free in Progress MarkLogic Server JavaScript engine integration (CVSS 8.0)
- [CVE-2026-85964](https://cve.now/CVE-2026-85964.md): Path traversal in Progress MarkLogic Server Query Console (CVSS 7.7)
- [CVE-2026-85963](https://cve.now/CVE-2026-85963.md): Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector (CVSS 7.5)
- [CVE-2026-85962](https://cve.now/CVE-2026-85962.md): Improper authentication in Progress MarkLogic Server SAML processing (CVSS 7.5)
- [CVE-2026-85961](https://cve.now/CVE-2026-85961.md): Sensitive information exposure in Progress MarkLogic Server Azure deployments (CVSS 7.5)
- [CVE-2026-85960](https://cve.now/CVE-2026-85960.md): Cross-site request forgery in Progress MarkLogic Server Query Console (CVSS 7.5)
- [CVE-2026-85959](https://cve.now/CVE-2026-85959.md): Insufficient authentication logging in Progress MarkLogic Server (CVSS 7.5)
- [CVE-2026-85958](https://cve.now/CVE-2026-85958.md): Improper OAuth token validation in Progress MarkLogic Server (CVSS 7.5)
- [CVE-2026-85957](https://cve.now/CVE-2026-85957.md): Improper XML external entity restriction in Progress MarkLogic Server SAML processing (CVSS 7.5)
- [CVE-2026-85956](https://cve.now/CVE-2026-85956.md): Improper privilege management in Progress MarkLogic Server backup and restore operations (CVSS 9.6)
- [CVE-2026-85955](https://cve.now/CVE-2026-85955.md): Improper privilege management in Progress MarkLogic Server xdmp:eval-in (CVSS 9.9)
- [CVE-2026-85954](https://cve.now/CVE-2026-85954.md): Improper privilege management in Progress MarkLogic Server higher-order XQuery functions (CVSS 8.6)
- [CVE-2026-85953](https://cve.now/CVE-2026-85953.md): Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio (CVSS 8.5)
- [CVE-2026-85952](https://cve.now/CVE-2026-85952.md): Server-side request forgery in Progress MarkLogic Server Linux cloud deployments (CVSS 8.5)
- [CVE-2026-85951](https://cve.now/CVE-2026-85951.md): Server-side request forgery in Progress MarkLogic Server Azure deployments (CVSS 8.5)
- [CVE-2026-85950](https://cve.now/CVE-2026-85950.md): Improper privilege management in Progress MarkLogic Server REST extensions (CVSS 8.4)
- [CVE-2026-85949](https://cve.now/CVE-2026-85949.md): Sensitive information exposure in Progress MarkLogic Server trace logs (CVSS 8.1)
- [CVE-2026-85948](https://cve.now/CVE-2026-85948.md): Improper privilege management in Progress MarkLogic Server Management API (CVSS 9.9)
- [CVE-2026-85947](https://cve.now/CVE-2026-85947.md): Improper privilege management in Progress MarkLogic Server forest operations (CVSS 9.9)
- [CVE-2026-9191](https://cve.now/CVE-2026-9191.md): Insufficient isolation of user-supplied code in Progress MarkLogic Server (CVSS 9.6)
- [CVE-2026-106139](https://cve.now/CVE-2026-106139.md): Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue (CVSS 5.4)
- [CVE-2026-106138](https://cve.now/CVE-2026-106138.md): Cross-Site Scripting via Chart Tooltip in KendoReact (CVSS 5.4)
- [CVE-2026-106155](https://cve.now/CVE-2026-106155.md): Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers (CVSS 8.9)
- [CVE-2026-106145](https://cve.now/CVE-2026-106145.md): Privilege Escalation in Telerik Report Server Service-Agent Hub (CVSS 7.1)
- [CVE-2026-106164](https://cve.now/CVE-2026-106164.md): Infinite Loop in Telerik Document Processing XLS Import (CVSS 7.3)
- [CVE-2026-91140](https://cve.now/CVE-2026-91140.md): OS command injection in Progress Software Autonomous REST Connector GenAI Agents (CVSS 9.6)
- [CVE-2026-92931](https://cve.now/CVE-2026-92931.md): CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK (CVSS 8.8)
- [CVE-2026-77805](https://cve.now/CVE-2026-77805.md): Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic (CVSS 7.9)
- [CVE-2026-77804](https://cve.now/CVE-2026-77804.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic (CVSS 6.6)
- [CVE-2026-77803](https://cve.now/CVE-2026-77803.md): Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic (CVSS 3.6)
- [CVE-2026-77802](https://cve.now/CVE-2026-77802.md): HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic (CVSS 6.3)
- [CVE-2026-86158](https://cve.now/CVE-2026-86158.md): Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere (CVSS 7.7)
- [CVE-2026-86157](https://cve.now/CVE-2026-86157.md): Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere (CVSS 5.6)
- [CVE-2026-80462](https://cve.now/CVE-2026-80462.md): Privilege Escalation in Progress Chef Automate (CVSS 10.0)
- [CVE-2026-19219](https://cve.now/CVE-2026-19219.md): DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
- [CVE-2026-18672](https://cve.now/CVE-2026-18672.md): RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
- [CVE-2026-65941](https://cve.now/CVE-2026-65941.md): WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling… (CVSS 9.8)
- [CVE-2026-65940](https://cve.now/CVE-2026-65940.md): WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server. (CVSS 6.8)
- [CVE-2026-65939](https://cve.now/CVE-2026-65939.md): WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler. (CVSS 6.8)
- [CVE-2026-65938](https://cve.now/CVE-2026-65938.md): WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API. (CVSS 4.3)
- [CVE-2026-65937](https://cve.now/CVE-2026-65937.md): WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI (CVSS 8.0)
- [CVE-2026-9203](https://cve.now/CVE-2026-9203.md): Server-side request forgery in Progress MarkLogic Server (CVSS 8.5)
- [CVE-2026-9195](https://cve.now/CVE-2026-9195.md): Cross-site scripting in Progress MarkLogic Server Query Console (CVSS 9.3)
- [CVE-2026-9193](https://cve.now/CVE-2026-9193.md): Privilege escalation in Progress MarkLogic Server Hadoop integration (CVSS 9.9)
- [CVE-2026-9192](https://cve.now/CVE-2026-9192.md): Authentication bypass in Progress MarkLogic Server ODBC App Server (CVSS 9.8)
- [CVE-2026-9190](https://cve.now/CVE-2026-9190.md): HTTP request smuggling in Progress MarkLogic Server (CVSS 9.1)
- [CVE-2026-8709](https://cve.now/CVE-2026-8709.md): Privilege escalation in Progress MarkLogic Server REST document patch operation (CVSS 9.9)
- [CVE-2026-7557](https://cve.now/CVE-2026-7557.md): SAML authentication bypass in Progress MarkLogic Server (CVSS 9.1)
- [CVE-2026-7329](https://cve.now/CVE-2026-7329.md): Privilege escalation in Progress MarkLogic Server REST query interfaces (CVSS 9.9)
- [CVE-2026-7327](https://cve.now/CVE-2026-7327.md): Privilege escalation in Progress MarkLogic Server REST API document processing (CVSS 8.1)
- [CVE-2026-7326](https://cve.now/CVE-2026-7326.md): Cross-site request forgery in Progress MarkLogic Server Admin UI (CVSS 7.5)
- [CVE-2026-59690](https://cve.now/CVE-2026-59690.md): Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API (CVSS 8.0)
- [CVE-2026-59689](https://cve.now/CVE-2026-59689.md): Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root (CVSS 8.0)
- [CVE-2026-59688](https://cve.now/CVE-2026-59688.md): Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality (CVSS 8.4)
- [CVE-2026-59687](https://cve.now/CVE-2026-59687.md): Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface (CVSS 8.4)
- [CVE-2026-59686](https://cve.now/CVE-2026-59686.md): Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface (CVSS 8.4)
- [CVE-2026-14932](https://cve.now/CVE-2026-14932.md): Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart (CVSS 6.5)
- [CVE-2026-14865](https://cve.now/CVE-2026-14865.md): XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX (CVSS 5.3)
- [CVE-2026-13192](https://cve.now/CVE-2026-13192.md): RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 6.5)
- [CVE-2026-13190](https://cve.now/CVE-2026-13190.md): PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
- [CVE-2026-13189](https://cve.now/CVE-2026-13189.md): SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
- [CVE-2026-13188](https://cve.now/CVE-2026-13188.md): DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 5.9)
- [CVE-2026-13187](https://cve.now/CVE-2026-13187.md): DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
- [CVE-2026-13186](https://cve.now/CVE-2026-13186.md): AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
- [CVE-2026-13185](https://cve.now/CVE-2026-13185.md): PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
- [CVE-2026-13184](https://cve.now/CVE-2026-13184.md): RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
- [CVE-2026-13183](https://cve.now/CVE-2026-13183.md): RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
- [CVE-2026-13182](https://cve.now/CVE-2026-13182.md): RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
- [CVE-2026-13181](https://cve.now/CVE-2026-13181.md): RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
- [CVE-2026-8079](https://cve.now/CVE-2026-8079.md): Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon (CVSS 8.7)
- [CVE-2026-9272](https://cve.now/CVE-2026-9272.md): Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS (CVSS 8.7)
- [CVE-2026-8037](https://cve.now/CVE-2026-8037.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 9.6, KEV)
- [CVE-2026-7313](https://cve.now/CVE-2026-7313.md): CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity (CVSS 8.7)
- [CVE-2026-7312](https://cve.now/CVE-2026-7312.md): CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity (CVSS 10.0)
- [CVE-2026-7201](https://cve.now/CVE-2026-7201.md): CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity (CVSS 8.8)
- [CVE-2026-7198](https://cve.now/CVE-2026-7198.md): CWE-284: Improper Access Control in web services in Progress Sitefinity (CVSS 9.8)
- [CVE-2026-7195](https://cve.now/CVE-2026-7195.md): CWE-20: Improper Input Validation in web services in Progress Sitefinity (CVSS 8.8)
- [CVE-2026-8488](https://cve.now/CVE-2026-8488.md): Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation (CVSS 4.3)
- [CVE-2026-8487](https://cve.now/CVE-2026-8487.md): Incorrect default permissions vulnerability in Progress Software MOVEit Automation (CVSS 6.5)
- [CVE-2026-8486](https://cve.now/CVE-2026-8486.md): Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation (CVSS 5.3)
- [CVE-2026-8485](https://cve.now/CVE-2026-8485.md): Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation (CVSS 5.9)
- [CVE-2026-5174](https://cve.now/CVE-2026-5174.md): Improper Access Control Vulnerability in Progress MOVEit Automation (CVSS 7.7)
- [CVE-2026-4670](https://cve.now/CVE-2026-4670.md): Improper Authentication vulnerability in Progress MOVEit Automation (CVSS 9.8)
- [CVE-2026-6023](https://cve.now/CVE-2026-6023.md): Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
- [CVE-2026-6022](https://cve.now/CVE-2026-6022.md): Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
- [CVE-2026-4048](https://cve.now/CVE-2026-4048.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4)
- [CVE-2026-3519](https://cve.now/CVE-2026-3519.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4)
- [CVE-2026-3518](https://cve.now/CVE-2026-3518.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4)
- [CVE-2026-3517](https://cve.now/CVE-2026-3517.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 8.4)
- [CVE-2025-8095](https://cve.now/CVE-2025-8095.md): Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge (CVSS 9.1)
- [CVE-2025-7389](https://cve.now/CVE-2025-7389.md): Unauthorized Arbitrary File Read via RMI in AdminServer Interface (CVSS 8.2)
- [CVE-2026-2737](https://cve.now/CVE-2026-2737.md): Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application (CVSS 8.5)
- [CVE-2026-3692](https://cve.now/CVE-2026-3692.md): Unintended command execution during report generation in Progress Flowmon (CVSS 8.7)
- [CVE-2026-2514](https://cve.now/CVE-2026-2514.md): Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application (CVSS 8.6)
- [CVE-2026-2513](https://cve.now/CVE-2026-2513.md): Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web application (CVSS 8.6)
- [CVE-2026-2878](https://cve.now/CVE-2026-2878.md): Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 5.3)
- [CVE-2025-6723](https://cve.now/CVE-2025-6723.md): Untrusted user data can lead to privilege escalation (CVSS 5.8)
- [CVE-2025-13447](https://cve.now/CVE-2025-13447.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster (CVSS 8.4)
- [CVE-2025-13444](https://cve.now/CVE-2025-13444.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster (CVSS 8.4)
- [CVE-2025-13774](https://cve.now/CVE-2025-13774.md): SQL injection leading to privilege escalation in Progress Flowmon ADS (CVSS 8.8)
- [CVE-2025-11906](https://cve.now/CVE-2025-11906.md): Privilege escalation via writable configuration files in Progress Flowmon (CVSS 6.7)
- [CVE-2025-10240](https://cve.now/CVE-2025-10240.md): Possibility of unintended actions when a user clicks a malicious link in the Progress Flowmon web application (CVSS 8.8)
- [CVE-2025-10239](https://cve.now/CVE-2025-10239.md): Unintended command execution via troubleshooting scripts in Progress Flowmon (CVSS 7.2)
- [CVE-2025-8868](https://cve.now/CVE-2025-8868.md): Chef Automate compliance service SQL Injection Vulnerability (CVSS 9.8)
- [CVE-2025-6724](https://cve.now/CVE-2025-6724.md): Chef Automate SQL Injection Vulnerability (CVSS 8.8)
- [CVE-2025-7388](https://cve.now/CVE-2025-7388.md): Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface (CVSS 8.4)
- [CVE-2025-6505](https://cve.now/CVE-2025-6505.md): Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux (CVSS 8.1)
- [CVE-2025-6504](https://cve.now/CVE-2025-6504.md): Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header (CVSS 8.4)
- [CVE-2025-6725](https://cve.now/CVE-2025-6725.md): Cross-Site Scripting (XSS) in PdfViewer (CVSS 5.4)
- [CVE-2025-3600](https://cve.now/CVE-2025-3600.md): Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
- [CVE-2025-2572](https://cve.now/CVE-2025-2572.md): WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability (CVSS 5.6)
- [CVE-2025-1968](https://cve.now/CVE-2025-1968.md): Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances all (CVSS 7.7)
- [CVE-2024-6097](https://cve.now/CVE-2024-6097.md): Absolute Path Traversal Vulnerability (CVSS 5.3)
- [CVE-2024-11629](https://cve.now/CVE-2024-11629.md): Telerik Document Processing RTF Export of Arbitrary File Path (CVSS 7.1)
- [CVE-2024-11628](https://cve.now/CVE-2024-11628.md): Prototype Pollution in Progress® Telerik® Kendo UI for Vue (CVSS 4.1)
- [CVE-2024-11343](https://cve.now/CVE-2024-11343.md): Telerik Document Processing Path Traversal (CVSS 8.3)
- [CVE-2024-12629](https://cve.now/CVE-2024-12629.md): Prototype Pollution in Progress® Telerik® KendoReact (CVSS 4.1)
- [CVE-2025-0332](https://cve.now/CVE-2025-0332.md): Progress UI for WinForms decompression path traversal vulnerability (CVSS 7.8)
- [CVE-2025-0556](https://cve.now/CVE-2025-0556.md): Telerik Report Server Clear Text Transmission of Agent Commands (CVSS 8.8)
- [CVE-2024-12251](https://cve.now/CVE-2024-12251.md): Improper neutralization special element in hyperlinks (CVSS 7.8)
- [CVE-2024-11626](https://cve.now/CVE-2024-11626.md): Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerabilit (CVSS 8.4)
- [CVE-2024-11625](https://cve.now/CVE-2024-11625.md): Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from (CVSS 7.7)
- [CVE-2024-12105](https://cve.now/CVE-2024-12105.md): WhatsUp Gold - SnmpExtendedActiveMonitor path traversal (CVSS 6.5)
- [CVE-2024-12106](https://cve.now/CVE-2024-12106.md): WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication (CVSS 9.4)
- [CVE-2024-12108](https://cve.now/CVE-2024-12108.md): WhatsUp Gold - Public API signing key rotation issue (CVSS 9.6)
- [CVE-2024-10095](https://cve.now/CVE-2024-10095.md): Progress UI for WPF format provider unsafe deserialization vulnerability (CVSS 8.4)
- [CVE-2024-8785](https://cve.now/CVE-2024-8785.md): WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability (CVSS 9.8)
- [CVE-2024-46909](https://cve.now/CVE-2024-46909.md): WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability (CVSS 9.8)
- [CVE-2024-46905](https://cve.now/CVE-2024-46905.md): WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability (CVSS 8.8)
- [CVE-2024-46906](https://cve.now/CVE-2024-46906.md): WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability (CVSS 8.8)
- [CVE-2024-46907](https://cve.now/CVE-2024-46907.md): WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability (CVSS 8.8)
- [CVE-2024-46908](https://cve.now/CVE-2024-46908.md): WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability (CVSS 8.8)
- [CVE-2024-7295](https://cve.now/CVE-2024-7295.md): Hard-coded credentials used for temporary and cache data encryption (CVSS 7.1)
- [CVE-2024-8049](https://cve.now/CVE-2024-8049.md): Telerik Document Processing Improper Handling of Memory Resources (CVSS 6.5)
- [CVE-2024-10012](https://cve.now/CVE-2024-10012.md): Progress UI for WPF format provider unsafe deserialization vulnerability (CVSS 7.8)
- [CVE-2024-10013](https://cve.now/CVE-2024-10013.md): Progress UI for WinForms format provider unsafe deserialization vulnerability (CVSS 7.8)
- [CVE-2024-9999](https://cve.now/CVE-2024-9999.md): Multi-Factor Authentication Bypass in Progress WS\_FTP Server (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/progress-software
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.