Progress Software
85 CVEs across 34 Progress Software products. Browse Progress Software vulnerabilities, severities, and proof-of-concept exploits.
Progress Software products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59690 | High | 8.0 | 2026-07-27 | A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant al… |
CVE-2026-59689 | High | 8.0 | 2026-07-27 | An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an aut… |
CVE-2026-59688 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59687 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-59686 | High | 8.4 | 2026-07-27 | An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authen… |
CVE-2026-14932 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and… |
CVE-2026-14865 | Medium | 5.3 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowin… |
CVE-2026-13192 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authentic… |
CVE-2026-13190 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from atta… |
CVE-2026-13189 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to i… |
CVE-2026-13188 | Medium | 5.9 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior… |
CVE-2026-13187 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enab… |
CVE-2026-13186 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the… |
CVE-2026-13185 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-… |
CVE-2026-13184 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload… |
CVE-2026-13183 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing dif… |
CVE-2026-13182 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failure… |
CVE-2026-13181 | High | 8.1 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-control… |
CVE-2026-9272 | High | 8.1 | 2026-07-02 | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the A… |
CVE-2026-8079 | High | 7.3 | 2026-07-02 | In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PD… |
CVE-2026-8037 | Critical | 9.6 | 2026-06-04 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on t… |
CVE-2026-7313 | High | 8.7 | 2026-06-02 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker… |
CVE-2026-7312 | Critical | 10.0 | 2026-06-02 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1… |
CVE-2026-7201 | High | 8.8 | 2026-06-02 | CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x b… |
CVE-2026-7198 | Critical | 9.8 | 2026-06-02 | CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content t… |
CVE-2026-7195 | High | 8.8 | 2026-06-02 | CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before… |
CVE-2026-8488 | Medium | 4.3 | 2026-05-20 | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVE… |
CVE-2026-8487 | Medium | 6.5 | 2026-05-20 | Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automati… |
CVE-2026-8486 | Medium | 5.3 | 2026-05-20 | Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automatio… |
CVE-2026-8485 | Medium | 5.9 | 2026-05-20 | Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before… |
CVE-2026-5174 | High | 7.7 | 2026-04-30 | Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation. This issue affects MOVEit Automation: from 2025.1… |
CVE-2026-4670 | Critical | 9.8 | 2026-04-30 | Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automat… |
CVE-2026-6023 | High | 8.1 | 2026-04-22 | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filte… |
CVE-2026-6022 | High | 7.5 | 2026-04-22 | In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to e… |
CVE-2026-4048 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbi… |
CVE-2026-3519 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions… |
CVE-2026-3518 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arb… |
CVE-2026-3517 | High | 8.4 | 2026-04-20 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions… |
CVE-2026-3692 | High | 8.8 | 2026-04-02 | In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generat… |
CVE-2026-2737 | Medium | 6.1 | 2026-04-02 | A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker ma… |
CVE-2026-2514 | | 2026-03-12 | In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft mali… | |
CVE-2026-2513 | | 2026-03-12 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacke… | |
CVE-2026-2878 | Medium | 5.3 | 2026-02-25 | In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary… |
CVE-2025-6723 | | 2026-01-30 | Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere w… | |
CVE-2025-13447 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-13444 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-13774 | High | 8.8 | 2026-01-13 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute u… |
CVE-2025-11906 | Medium | 6.7 | 2025-10-30 | A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with… |
CVE-2025-10240 | High | 8.8 | 2025-10-09 | A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may… |
CVE-2025-10239 | High | 7.2 | 2025-10-09 | In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interfac… |
CVE-2025-8868 | Critical | 9.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-6724 | High | 8.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-6505 | High | 8.1 | 2025-07-29 | Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerabilit… |
CVE-2025-6504 | High | 8.4 | 2025-07-29 | In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-con… |
CVE-2025-6725 | Medium | 5.4 | 2025-07-02 | In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages… |
CVE-2025-3600 | High | 7.5 | 2025-05-14 | In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulti… |
CVE-2024-11629 | High | 7.1 | 2025-02-12 | In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary pa… |
CVE-2024-11628 | Medium | 4.1 | 2025-02-12 | In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which c… |
CVE-2025-0556 | High | 8.8 | 2025-02-12 | In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive… |
CVE-2025-0332 | High | 7.8 | 2025-02-12 | In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an arch… |
CVE-2024-12629 | Medium | 4.1 | 2025-02-12 | In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can res… |
CVE-2024-11343 | High | 8.3 | 2025-02-12 | In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access. |
CVE-2024-12251 | High | 7.8 | 2025-02-12 | In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink element… |
CVE-2024-10095 | High | 8.4 | 2024-12-16 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-8049 | Medium | 6.5 | 2024-11-13 | In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessiv… |
CVE-2024-10013 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerabil… |
CVE-2024-10012 | High | 7.8 | 2024-11-13 | In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-8048 | High | 7.8 | 2024-10-09 | In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evalu… |
CVE-2024-8015 | Critical | 9.1 | 2024-10-09 | In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure… |
CVE-2024-8014 | High | 8.8 | 2024-10-09 | In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolu… |
CVE-2024-7840 | High | 7.8 | 2024-10-09 | In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elem… |
CVE-2024-8316 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-7679 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink… |
CVE-2024-7576 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability. |
CVE-2024-7575 | High | 7.8 | 2024-09-25 | In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elem… |
CVE-2024-4837 | Medium | 5.3 | 2024-05-15 | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restr… |
CVE-2024-4357 | Medium | 6.5 | 2024-05-15 | An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to re… |
CVE-2024-2389 | Critical | 10.0 | 2024-04-02 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain ent… |
CVE-2024-2449 | High | 7.5 | 2024-03-22 | A cross-site request forgery vulnerability has been identified in LoadMaster. It is possible for a malicious actor, who has prior knowledge of the IP or hostn… |
CVE-2024-2448 | High | 8.4 | 2024-03-22 | An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands… |
CVE-2024-2291 | Medium | 4.3 | 2024-03-20 | In Progress MOVEit Transfer versions released before 2022.0.11 (14.0.11), 2022.1.12 (14.1.12), 2023.0.9 (15.0.9), 2023.1.4 (15.1.4), a logging bypass vulnerab… |
CVE-2024-1212 | Critical | 10.0 | 2024-02-21 | Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. |
CVE-2024-0833 | High | 7.8 | 2024-01-31 | In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In a… |
CVE-2024-0832 | High | 7.8 | 2024-01-31 | In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environ… |
CVE-2024-0219 | High | 7.8 | 2024-01-31 | In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an env… |