[ Vendor · 35 CVEs ]
Progress Software Corporation
CVEs affecting Progress Software Corporation published in the last 30 days, plus any Progress Software Corporation CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-85973 | 12 Oct 2026 | CVSS 7.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned… | |
| CVE-2026-85974 | 12 Oct 2026 | CVSS 7.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for… | |
| CVE-2026-85975 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by… | |
| CVE-2026-85976 | 12 Oct 2026 | CVSS 5.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console… | |
| CVE-2026-85965 | 12 Oct 2026 | CVSS 8.0 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine… | |
| CVE-2026-85966 | 12 Oct 2026 | CVSS 7.7 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain… | |
| CVE-2026-85967 | 12 Oct 2026 | CVSS 6.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a… | |
| CVE-2026-85968 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote… | |
| CVE-2026-85969 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain… | |
| CVE-2026-85970 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple… | |
| CVE-2026-85971 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to… | |
| CVE-2026-85972 | 12 Oct 2026 | CVSS 7.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos… | |
| CVE-2026-85958 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow… | |
| CVE-2026-85959 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in… | |
| CVE-2026-85960 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker… | |
| CVE-2026-85961 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerOn Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive… | |
| CVE-2026-85962 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML… | |
| CVE-2026-85963 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses… | |
| CVE-2026-85964 | 12 Oct 2026 | CVSS 7.7 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path… | |
| CVE-2026-85957 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerAffected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which… | |
| CVE-2026-9191 | 12 Oct 2026 | CVSS 9.6 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through… | |
| CVE-2026-85955 | 12 Oct 2026 | CVSS 9.9 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke… | |
| CVE-2026-85956 | 12 Oct 2026 | CVSS 9.6 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator… | |
| CVE-2026-85947 | 12 Oct 2026 | CVSS 9.9 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management… | |
| CVE-2026-85948 | 12 Oct 2026 | CVSS 9.9 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API… | |
| CVE-2026-85949 | 12 Oct 2026 | CVSS 8.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs… | |
| CVE-2026-85950 | 12 Oct 2026 | CVSS 8.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote… | |
| CVE-2026-85951 | 12 Oct 2026 | CVSS 8.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability… | |
| CVE-2026-85952 | 12 Oct 2026 | CVSS 8.5 | Progress Software Corporation MarkLogic ServerAffected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery… | |
| CVE-2026-85953 | 12 Oct 2026 | CVSS 8.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not… | |
| CVE-2026-85954 | 12 Oct 2026 | CVSS 8.6 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain… | |
| CVE-2024-6670 | 29 Aug 2024 | CVSS 9.8 | Progress WhatsUp Gold SQL InjectionIn WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted… | Exploited |
| CVE-2024-4885 | 25 Jun 2024 | CVSS 9.8 | Progress WhatsUp Gold Path TraversalIn WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The… | Exploited |
| CVE-2024-4358 | 29 May 2024 | CVSS 9.8 | Progress Telerik Report Server Authentication Bypass by SpoofingIn Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report… | Exploited |
| CVE-2023-40044 | 27 Sep 2023 | CVSS 8.8 | Progress WS_FTP Server Deserialization of Untrusted DataIn WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc… | Exploited |