[ Vendor · 30 CVEs ]
Progress Software
CVEs affecting Progress Software published in the last 30 days, plus any Progress Software CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106150 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component… | |
| CVE-2026-106151 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from… | |
| CVE-2026-106153 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and… | |
| CVE-2026-108116 | 15 Oct 2026 | CVSS 7.5 | Progress Software Kendo UI for jQueryIn Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or… | |
| CVE-2026-106149 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string… | |
| CVE-2026-106163 | 15 Oct 2026 | CVSS 6.5 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render… | |
| CVE-2026-106147 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound… | |
| CVE-2026-106148 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into… | |
| CVE-2026-106157 | 15 Oct 2026 | CVSS 4.7 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL… | |
| CVE-2026-106158 | 15 Oct 2026 | CVSS 4.7 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into… | |
| CVE-2026-106159 | 15 Oct 2026 | CVSS 4.7 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into… | |
| CVE-2026-106160 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe… | |
| CVE-2026-106161 | 15 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw… | |
| CVE-2026-106162 | 15 Oct 2026 | CVSS 4.7 | Progress Software Kendo UI for jQueryIn Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied… | |
| CVE-2026-106139 | 10 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for VueIn Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the… | |
| CVE-2026-106138 | 10 Oct 2026 | CVSS 5.4 | Progress Software KendoReactIn Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the… | |
| CVE-2026-106145 | 9 Oct 2026 | CVSS 7.1 | Progress Software Telerik Report ServerIn Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an… | |
| CVE-2026-106155 | 9 Oct 2026 | CVSS 8.9 | Progress Software Telerik Report ServerIn Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows… | |
| CVE-2026-106164 | 7 Oct 2026 | CVSS 7.3 | Progress Software Telerik Document Processing LibrariesIn Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when… | |
| CVE-2026-91140 | 6 Oct 2026 | CVSS 9.6 | Progress Software Autonomous REST Connector GenAI AgentsAn OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI… | |
| CVE-2026-92931 | 5 Oct 2026 | CVSS 8.8 | Progress Software @progress/sitefinity-nextjs-sdkCWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a… | |
| CVE-2026-77802 | 5 Oct 2026 | CVSS 6.3 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request… | |
| CVE-2026-77803 | 5 Oct 2026 | CVSS 3.6 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy… | |
| CVE-2026-77804 | 5 Oct 2026 | CVSS 6.6 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in… | |
| CVE-2026-77805 | 5 Oct 2026 | CVSS 7.9 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools… | |
| CVE-2026-86157 | 29 Sep 2026 | CVSS 5.6 | Progress Software Progress® Telerik® Fiddler® EverywhereExposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can… | |
| CVE-2026-86158 | 29 Sep 2026 | CVSS 7.7 | Progress Software Progress® Telerik® Fiddler® EverywhereMissing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated… | |
| CVE-2026-8037 | 4 Jun 2026 | CVSS 9.8 | Progress LoadMaster Command InjectionOS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary… | ExploitedFix |
| CVE-2024-4358 | 29 May 2024 | CVSS 9.8 | Progress Telerik Report Server Authentication Bypass by SpoofingIn Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report… | Exploited |
| CVE-2024-1212 | 21 Feb 2024 | CVSS 9.8 | Progress Kemp LoadMaster OS Command InjectionUnauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. | Exploited |