[ Vendor · 28 CVEs ]
Progress
CVEs affecting Progress published in the last 30 days, plus any Progress CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-89077 | 14 Oct 2026 | CVSS 8.8 | Progress MOVEit TransferIncorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer… | |
| CVE-2026-89068 | 14 Oct 2026 | CVSS 9.8 | Progress MOVEit TransferMissing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6… | |
| CVE-2026-89069 | 14 Oct 2026 | CVSS 5.4 | Progress MOVEit TransferImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This… | |
| CVE-2026-89070 | 14 Oct 2026 | CVSS 7.5 | Progress MOVEit TransferAuthentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6… | |
| CVE-2026-89071 | 14 Oct 2026 | CVSS 8.8 | Progress MOVEit TransferImproper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This… | |
| CVE-2026-89072 | 14 Oct 2026 | CVSS 8.8 | Progress MOVEit TransferIncorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6… | |
| CVE-2026-89073 | 14 Oct 2026 | CVSS 9.8 | Progress MOVEit TransferInsufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0… | |
| CVE-2026-89074 | 14 Oct 2026 | CVSS 8.8 | Progress MOVEit TransferImproper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from… | |
| CVE-2026-89075 | 14 Oct 2026 | CVSS 7.3 | Progress MOVEit TransferInsecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from… | |
| CVE-2026-89076 | 14 Oct 2026 | CVSS 8.8 | Progress MOVEit TransferImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports… | |
| CVE-2026-87093 | 14 Oct 2026 | CVSS 8.8 | Progress MOVEit TransferIncorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6… | |
| CVE-2026-89067 | 14 Oct 2026 | CVSS 8.8 | Progress MOVEit TransferAuthentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before… | |
| CVE-2026-93693 | 12 Oct 2026 | CVSS 6.5 | Progress ShareFile Storage Zones ControllerIn Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP… | |
| CVE-2026-93694 | 12 Oct 2026 | CVSS 4.0 | Progress ShareFile Storage Zones ControllerIn Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL… | |
| CVE-2026-93695 | 12 Oct 2026 | CVSS 7.4 | Progress ShareFile Storage Zones ControllerIn Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary… | |
| CVE-2026-8037 | 4 Jun 2026 | CVSS 9.8 | Progress LoadMaster Command InjectionOS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary… | ExploitedFix |
| CVE-2024-6670 | 29 Aug 2024 | CVSS 9.8 | Progress WhatsUp Gold SQL InjectionIn WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted… | Exploited |
| CVE-2024-6670 | 29 Aug 2024 | CVSS 9.8 | Progress WhatsUp Gold SQL InjectionIn WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted… | Exploited |
| CVE-2024-4885 | 25 Jun 2024 | CVSS 9.8 | Progress WhatsUp Gold Path TraversalIn WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The… | Exploited |
| CVE-2024-4885 | 25 Jun 2024 | CVSS 9.8 | Progress WhatsUp Gold Path TraversalIn WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The… | Exploited |
| CVE-2024-4358 | 29 May 2024 | CVSS 9.8 | Progress Telerik Report Server Authentication Bypass by SpoofingIn Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report… | Exploited |
| CVE-2024-1212 | 21 Feb 2024 | CVSS 9.8 | Progress Kemp LoadMaster OS Command InjectionUnauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. | Exploited |
| CVE-2023-40044 | 27 Sep 2023 | CVSS 8.8 | Progress WS_FTP Server Deserialization of Untrusted DataIn WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc… | Exploited |
| CVE-2023-34362 | 2 Jun 2023 | CVSS 9.8 | Progress MOVEit Transfer SQL InjectionIn Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection… | Exploited |
| CVE-2023-34362 | 2 Jun 2023 | CVSS 9.8 | Progress MOVEit Transfer SQL InjectionIn Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection… | Exploited |
| CVE-2019-18935 | 11 Dec 2019 | CVSS 9.8 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted DataProgress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is… | ExploitedFix |
| CVE-2017-11357 | 23 Aug 2017 | CVSS 9.8 | Telerik UI for ASP.NET AJAX Insecure Direct Object ReferenceProgress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to… | Exploited |
| CVE-2017-9248 | 3 Jul 2017 | CVSS 9.8 | Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic WeaknessTelerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect… | Exploited |