Progress Software vulnerabilities
285 CVEs and advisories name Progress Software as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-14865XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX
- CVE-2026-13192RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13190PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13189SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13188DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13187DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13186AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13185PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13184RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13183RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13182RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-13181RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-8079Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon
- CVE-2026-9272Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
- CVE-2026-8037OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- CVE-2026-7313CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
- CVE-2026-7312CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
- CVE-2026-7201CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
- CVE-2026-7198CWE-284: Improper Access Control in web services in Progress Sitefinity
- CVE-2026-7195CWE-20: Improper Input Validation in web services in Progress Sitefinity
- CVE-2026-8488Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
- CVE-2026-8487Incorrect default permissions vulnerability in Progress Software MOVEit Automation
- CVE-2026-8486Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
- CVE-2026-8485Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation
- CVE-2026-5174Improper Access Control Vulnerability in Progress MOVEit Automation
- CVE-2026-4670Improper Authentication vulnerability in Progress MOVEit Automation
- CVE-2026-6023Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-6022Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2026-4048OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- CVE-2026-3519OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF