Progress
100 CVEs across 84 Progress products. Browse Progress vulnerabilities, severities, and proof-of-concept exploits.
Progress products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59690 | High | 8.0 | 2026-07-27 | A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant al… |
CVE-2026-59689 | High | 8.0 | 2026-07-27 | An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an aut… |
CVE-2026-59688 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59687 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59686 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-15968 | High | 7.1 | 2026-07-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Tran… |
CVE-2026-15967 | High | 7.5 | 2026-07-23 | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. |
CVE-2026-15966 | High | 7.5 | 2026-07-23 | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5… |
CVE-2026-10697 | High | 7.5 | 2026-07-23 | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. |
CVE-2026-14932 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and… |
CVE-2026-14865 | Medium | 5.3 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowin… |
CVE-2026-13192 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authentic… |
CVE-2026-13190 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from atta… |
CVE-2026-13189 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to i… |
CVE-2026-13188 | Medium | 5.9 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior… |
CVE-2026-13187 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enab… |
CVE-2026-13186 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the… |
CVE-2026-13185 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-… |
CVE-2026-13184 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload… |
CVE-2026-13183 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing dif… |
CVE-2026-13182 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failure… |
CVE-2026-13181 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-control… |
CVE-2026-15724 | High | 8.7 | 2026-07-21 | In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerabil… |
CVE-2026-8801 | Low | 3.5 | 2026-07-08 | Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2… |
CVE-2026-8800 | Low | 2.7 | 2026-07-08 | Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 befo… |
CVE-2026-8651 | Low | 3.7 | 2026-07-08 | Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from… |
CVE-2026-8650 | Medium | 4.5 | 2026-07-08 | Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0… |
CVE-2026-8649 | Medium | 6.4 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit… |
CVE-2026-11903 | High | 8.0 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue aff… |
CVE-2026-10699 | High | 7.5 | 2026-07-08 | Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: fro… |
CVE-2026-10698 | High | 7.2 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit… |
CVE-2026-9272 | High | 8.1 | 2026-07-02 | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the A… |
CVE-2026-8079 | High | 7.3 | 2026-07-02 | In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PD… |
CVE-2026-8037 | Critical | 9.6 | 2026-06-04 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on t… |
CVE-2026-7313 | High | 8.7 | 2026-06-02 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker… |
CVE-2026-7312 | Critical | 10.0 | 2026-06-02 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1… |
CVE-2026-7201 | High | 8.8 | 2026-06-02 | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x b… |
CVE-2026-7198 | Critical | 9.8 | 2026-06-02 | CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content t… |
CVE-2026-7195 | High | 8.8 | 2026-06-02 | CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before… |
CVE-2026-8488 | Medium | 4.3 | 2026-05-20 | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVE… |
CVE-2026-8487 | Medium | 6.5 | 2026-05-20 | Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automati… |
CVE-2026-8486 | Medium | 5.3 | 2026-05-20 | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automatio… |
CVE-2026-8485 | Medium | 5.9 | 2026-05-20 | Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before… |
CVE-2026-5174 | High | 7.7 | 2026-04-30 | Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1… |
CVE-2026-4670 | Critical | 9.8 | 2026-04-30 | Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automat… |
CVE-2026-6023 | High | 8.1 | 2026-04-22 | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filte… |
CVE-2026-6022 | High | 7.5 | 2026-04-22 | In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to e… |
CVE-2026-4048 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbi… |
CVE-2026-3519 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions… |
CVE-2026-3518 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arb… |
CVE-2026-3517 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions… |
CVE-2026-3692 | High | 8.8 | 2026-04-02 | In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generat… |
CVE-2026-2737 | Medium | 6.1 | 2026-04-02 | A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker ma… |
CVE-2026-2701 | Critical | 9.1 | 2026-04-02 | Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution. |
CVE-2026-2699 | Critical | 9.8 | 2026-04-02 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing s… |
CVE-2026-2878 | Medium | 5.3 | 2026-02-25 | In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary… |
CVE-2025-13447 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-13444 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-13774 | High | 8.8 | 2026-01-13 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute u… |
CVE-2025-11235 | Low | 3.7 | 2026-01-07 | Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 202… |
CVE-2025-13147 | Medium | 5.3 | 2025-11-19 | Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4. |
CVE-2025-10703 | | 2025-11-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC d… | |
CVE-2025-10702 | | 2025-11-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC d… | |
CVE-2025-10932 | High | 8.2 | 2025-10-29 | Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, fro… |
CVE-2025-6505 | High | 8.1 | 2025-07-29 | Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerabilit… |
CVE-2025-6504 | High | 8.4 | 2025-07-29 | In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-con… |
CVE-2025-3600 | High | 7.5 | 2025-05-14 | In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulti… |
CVE-2025-2572 | Medium | 5.6 | 2025-04-14 | In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of Whats… |
CVE-2025-2324 | Medium | 5.9 | 2025-03-19 | Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This… |
CVE-2025-1758 | Medium | 4.3 | 2025-03-19 | Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versio… |
CVE-2024-6097 | Medium | 5.3 | 2025-02-12 | In Progress® Telerik® Reporting versions prior to 2025 Q1 (19.0.25.211), information disclosure is possible by a local threat actor through an absolute path vu… |
CVE-2024-11629 | High | 7.1 | 2025-02-12 | In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary pa… |
CVE-2024-11628 | Medium | 4.1 | 2025-02-12 | In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which c… |
CVE-2025-0556 | High | 8.8 | 2025-02-12 | In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive… |
CVE-2025-0332 | High | 7.8 | 2025-02-12 | In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an arch… |
CVE-2024-12629 | Medium | 4.1 | 2025-02-12 | In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can res… |
CVE-2024-11343 | High | 8.3 | 2025-02-12 | In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access. |
CVE-2024-12251 | High | 7.8 | 2025-02-12 | In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink element… |
CVE-2024-56135 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56134 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56133 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56132 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-56131 | High | 8.4 | 2025-02-05 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects: Product Affe… |
CVE-2024-11627 | Medium | 6.8 | 2025-01-07 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, fro… |
CVE-2024-11626 | High | 8.4 | 2025-01-07 | Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitef… |
CVE-2024-11625 | High | 7.7 | 2025-01-07 | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.81… |
CVE-2024-12108 | Critical | 9.6 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API. |
CVE-2024-12106 | Critical | 9.4 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings. |
CVE-2024-12105 | Medium | 6.5 | 2024-12-31 | In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure. |
CVE-2024-8785 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in… |
CVE-2024-46909 | Critical | 9.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the se… |
CVE-2024-46908 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46907 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46906 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permission… |
CVE-2024-46905 | High | 8.8 | 2024-12-02 | In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user (at least Network Manager permis… |
CVE-2024-8049 | Medium | 6.5 | 2024-11-13 | In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessiv… |
CVE-2024-7295 | High | 7.1 | 2024-11-13 | In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a soph… |
CVE-2024-10013 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerabil… |
CVE-2024-7763 | Critical | 9.8 | 2024-10-24 | In WhatsUp Gold versions released before 2024.0.0, an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials. |
CVE-2024-8755 | High | 8.4 | 2024-10-11 | Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affe… |