Progress vulnerabilities
56 CVEs and advisories name Progress as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-10698Table scope bypass vulnerability in custom reports
- CVE-2026-2701RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)
- CVE-2026-2699EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)
- CVE-2025-11235MOVEit Transfer REST API does not require current password in order to initiate the password change process
- CVE-2025-13147External Service Interaction (DNS)
- CVE-2025-10703Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress…
- CVE-2025-10702Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress…
- CVE-2025-10932AS2 module allows uncontrolled file uploads
- CVE-2025-1758Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above
- CVE-2025-2324A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder
- CVE-2024-56135Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56134Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56133Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56132Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-56131Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-11627: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 thr
- CVE-2024-8755Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
- CVE-2024-6658Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.
- CVE-2024-7591Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection
- CVE-2024-7346Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation
- CVE-2024-7345Direct local client connections to MS Agents can bypass authentication
- CVE-2024-7654Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service
- CVE-2024-6576MOVEit Transfer Privilege Escalation Vulnerability
- CVE-2024-5806MOVEit Transfer Authentication Bypass Vulnerability
- CVE-2024-5805MOVEit Gateway Authentication Bypass Vulnerability
- CVE-2024-1403Authentication Bypass in OpenEdge Authentication Gateway and AdminServer