Progress Software vulnerabilities
285 CVEs and advisories name Progress Software as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-3518OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- CVE-2026-3517OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
- CVE-2025-8095Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
- CVE-2025-7389Unauthorized Arbitrary File Read via RMI in AdminServer Interface
- CVE-2026-2737Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application
- CVE-2026-3692Unintended command execution during report generation in Progress Flowmon
- CVE-2026-2514Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application
- CVE-2026-2513Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web application
- CVE-2026-2878Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2025-6723Untrusted user data can lead to privilege escalation
- CVE-2025-13447OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster
- CVE-2025-13444OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster
- CVE-2025-13774SQL injection leading to privilege escalation in Progress Flowmon ADS
- CVE-2025-11906Privilege escalation via writable configuration files in Progress Flowmon
- CVE-2025-10240Possibility of unintended actions when a user clicks a malicious link in the Progress Flowmon web application
- CVE-2025-10239Unintended command execution via troubleshooting scripts in Progress Flowmon
- CVE-2025-8868Chef Automate compliance service SQL Injection Vulnerability
- CVE-2025-6724Chef Automate SQL Injection Vulnerability
- CVE-2025-7388Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface
- CVE-2025-6505Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux
- CVE-2025-6504Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header
- CVE-2025-6725Cross-Site Scripting (XSS) in PdfViewer
- CVE-2025-3600Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX
- CVE-2025-2572WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability
- CVE-2025-1968Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances all
- CVE-2024-6097Absolute Path Traversal Vulnerability
- CVE-2024-11629Telerik Document Processing RTF Export of Arbitrary File Path
- CVE-2024-11628Prototype Pollution in Progress® Telerik® Kendo UI for Vue
- CVE-2024-11343Telerik Document Processing Path Traversal
- CVE-2024-12629Prototype Pollution in Progress® Telerik® KendoReact