Progress Software vulnerabilities
285 CVEs and advisories name Progress Software as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-77805Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic
- CVE-2026-77804Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic
- CVE-2026-77803Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic
- CVE-2026-77802HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic
- CVE-2026-86158Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere
- CVE-2026-86157Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere
- CVE-2026-80462Privilege Escalation in Progress Chef Automate
- CVE-2026-19219DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-18672RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-65941WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling…
- CVE-2026-65940WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
- CVE-2026-65939WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.
- CVE-2026-65938WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.
- CVE-2026-65937WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI
- CVE-2026-9203Server-side request forgery in Progress MarkLogic Server
- CVE-2026-9195Cross-site scripting in Progress MarkLogic Server Query Console
- CVE-2026-9193Privilege escalation in Progress MarkLogic Server Hadoop integration
- CVE-2026-9192Authentication bypass in Progress MarkLogic Server ODBC App Server
- CVE-2026-9190HTTP request smuggling in Progress MarkLogic Server
- CVE-2026-8709Privilege escalation in Progress MarkLogic Server REST document patch operation
- CVE-2026-7557SAML authentication bypass in Progress MarkLogic Server
- CVE-2026-7329Privilege escalation in Progress MarkLogic Server REST query interfaces
- CVE-2026-7327Privilege escalation in Progress MarkLogic Server REST API document processing
- CVE-2026-7326Cross-site request forgery in Progress MarkLogic Server Admin UI
- CVE-2026-59690Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
- CVE-2026-59689Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root
- CVE-2026-59688Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality
- CVE-2026-59687Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface
- CVE-2026-59686Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface
- CVE-2026-14932Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart