Progress Software vulnerabilities
285 CVEs and advisories name Progress Software as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-84295Improper Authentication in Progress WS_FTP Server
- CVE-2026-84294Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
- CVE-2026-118037Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing
- CVE-2026-118036Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question…
- CVE-2026-118035Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing
- CVE-2026-118040Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing
- CVE-2026-118039XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
- CVE-2026-118038Path Traversal in Telerik Document Processing Libraries AI Agent Tools
- CVE-2026-108116MDX and SOAP Injection in Kendo UI for jQuery
- CVE-2026-106153Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
- CVE-2026-106151Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
- CVE-2026-106150Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip
- CVE-2026-106149Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
- CVE-2026-106148Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
- CVE-2026-106147Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
- CVE-2026-106161Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
- CVE-2026-106160Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery
- CVE-2026-106159Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery
- CVE-2026-106158Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery
- CVE-2026-106157Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery
- CVE-2026-106162Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery
- CVE-2026-106163Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
- CVE-2026-85976HTTP response splitting in Progress MarkLogic Server Query Console
- CVE-2026-85975Cleartext transmission in Progress MarkLogic Server Amazon S3 connections
- CVE-2026-85974Improper TLS hostname verification in Progress MarkLogic Server
- CVE-2026-85973Cleartext transmission in Progress MarkLogic Server cluster join operations
- CVE-2026-85972Improper Kerberos server verification in Progress MarkLogic Server
- CVE-2026-85971Incorrect log file permissions in Progress MarkLogic Server
- CVE-2026-85970Improper XML external entity restriction in Progress MarkLogic Server
- CVE-2026-85969Out-of-bounds write in Progress MarkLogic Server