Progress - vulnerabilities (CVEs)

333 CVEs in 91 products, 28 in the last 30 days, newest from 2026-10-15.

Products

• Whatsup Gold - 62 CVEs
• Moveit Transfer - 49 CVEs
• Ws Ftp Server - 28 CVEs
• Sitefinity - 24 CVEs
• Telerik Ui For Asp.net Ajax - 21 CVEs
• Loadmaster - 17 CVEs
• Telerik Reporting - 16 CVEs
• Kendo Ui - 14 CVEs
• Ecs Connection Manager - 12 CVEs
• Openedge - 12 CVEs
• Connection Manager For Objectscale - 11 CVEs
• Marklogic Server - 10 CVEs
• Sharefile Storage Zones Controller - 9 CVEs
• Telerik Report Server - 9 CVEs
• Moveit Automation - 8 CVEs
• Multi-tenant Loadmaster - 8 CVEs
• Moveit Web Application Firewall - 7 CVEs
• Progress - 5 CVEs
• Sitefinity Cms - 5 CVEs
• Whatsupgold - 5 CVEs
• Flowmon Anomaly Detection System - 4 CVEs
• Flowmon - 3 CVEs
• Telerik Document Processing Libraries - 3 CVEs
• Telerik Ui For Winforms - 3 CVEs
• Datadirect Connect For Jdbc Autonomous Rest Connector - 2 CVEs
• Datadirect Connect For Jdbc For Amazon Redshift - 2 CVEs
• Datadirect Connect For Jdbc For Apache Cassandra - 2 CVEs
• Datadirect Connect For Jdbc For Apache Impala - 2 CVEs
• Datadirect Connect For Jdbc For Apache Sparksql - 2 CVEs
• Datadirect Connect For Jdbc For Db2 - 2 CVEs
• Datadirect Connect For Jdbc For Google Analytics 4 - 2 CVEs
• Datadirect Connect For Jdbc For Google Bigquery - 2 CVEs
• Datadirect Connect For Jdbc For Greenplum - 2 CVEs
• Datadirect Connect For Jdbc For Hive - 2 CVEs
• Datadirect Connect For Jdbc For Informix - 2 CVEs
• Datadirect Connect For Jdbc For Microsoft Dynamics 365 - 2 CVEs
• Datadirect Connect For Jdbc For Microsoft Sharepoint - 2 CVEs
• Datadirect Connect For Jdbc For Microsoft Sqlserver - 2 CVEs
• Datadirect Connect For Jdbc For Mongodb - 2 CVEs
• Datadirect Connect For Jdbc For Mysql - 2 CVEs
• Datadirect Connect For Jdbc For Oracle Database - 2 CVEs
• Datadirect Connect For Jdbc For Oracle Eloqua - 2 CVEs
• Datadirect Connect For Jdbc For Oracle Sales Cloud - 2 CVEs
• Datadirect Connect For Jdbc For Oracle Service Cloud - 2 CVEs
• Datadirect Connect For Jdbc For Postgresql - 2 CVEs
• Datadirect Connect For Jdbc For Progress Openedge - 2 CVEs
• Datadirect Connect For Jdbc For Salesforce - 2 CVEs
• Datadirect Connect For Jdbc For Sap Hana - 2 CVEs
• Datadirect Connect For Jdbc For Sap S4 Hana - 2 CVEs
• Datadirect Connect For Jdbc For Snowflake - 2 CVEs
• Datadirect Connect For Jdbc For Sybase Ase - 2 CVEs
• Datadirect Hybrid Data Pipeline Docker - 2 CVEs
• Datadirect Hybrid Data Pipeline Jdbc Driver - 2 CVEs
• Datadirect Hybrid Data Pipeline On Premises Connector - 2 CVEs
• Datadirect Hybrid Data Pipeline Server - 2 CVEs
• Datadirect Odbc Oracle Wire Protocol Driver - 2 CVEs
• Datadirect Openaccess Jdbc Driver - 2 CVEs
• Flowmon Os - 2 CVEs
• Hybrid Data Pipeline - 2 CVEs
• Ipswitch Ws Ftp Server - 2 CVEs
• Multi-tenant Hypervisor - 2 CVEs
• Openedge Innovation - 2 CVEs
• Webspeed - 2 CVEs
• Webspeed Messenger - 2 CVEs
• 4gl Compiler - 1 CVEs
• Chef Infra Server - 1 CVEs
• Connection Manager For Objectscale* - 1 CVEs
• Database - 1 CVEs
• Fiddler - 1 CVEs
• Flowmon Packet Investigator - 1 CVEs
• Kendo Ui For Vue - 1 CVEs
• Kendoreact - 1 CVEs
• Mixlib-archive - 1 CVEs
• Moveit Cloud - 1 CVEs
• Moveit Gateway - 1 CVEs
• Moveit Waf - 1 CVEs
• Openedge Explorer - 1 CVEs
• Openedge Management - 1 CVEs
• Telerik Extensions For Asp.net Mvc - 1 CVEs
• Telerik Justdecompile - 1 CVEs
• Telerik Test Studio - 1 CVEs
• Telerik Ui - 1 CVEs
• Telerik Ui For Winui - 1 CVEs
• Ipswitch Ws Ftp Server With Ssh - 0 CVEs
• Moveit - 0 CVEs
• Objectstore - 0 CVEs
• Telerik Fiddler Classic - 0 CVEs
• Telerik Fiddler Everywhere - 0 CVEs
• Telerik Ui For Asp.net Core - 0 CVEs
• Telerik Ui For Blazor - 0 CVEs
• Telerik Ui For Wpf - 0 CVEs

Newest CVEs of Progress

• CVE-2026-108116 - CVSS 7.5 (high), 2026-10-15: In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject…
• CVE-2026-106153 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title…
• CVE-2026-106151 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-*…
• CVE-2026-106149 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation…
• CVE-2026-106148 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted…
• CVE-2026-106147 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField…
• CVE-2026-106161 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without…
• CVE-2026-106160 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths…
• CVE-2026-106159 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an…
• CVE-2026-106158 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted…
• CVE-2026-106157 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into…
• CVE-2026-106162 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names…
• CVE-2026-106163 - CVSS 6.5 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely…
• CVE-2026-89077 - CVSS 8.8 (high), 2026-10-14: Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before…
• CVE-2026-89076 - CVSS 8.8 (high), 2026-10-14: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This…
• CVE-2026-89075 - CVSS 7.3 (high), 2026-10-14: Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0…
• CVE-2026-89074 - CVSS 8.8 (high), 2026-10-14: Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before…
• CVE-2026-89073 - CVSS 9.8 (critical), 2026-10-14: Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before…
• CVE-2026-89072 - CVSS 8.8 (high), 2026-10-14: Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
• CVE-2026-89071 - CVSS 8.8 (high), 2026-10-14: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue…
• CVE-2026-89070 - CVSS 7.5 (high), 2026-10-14: Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
• CVE-2026-89069 - CVSS 8 (high), 2026-10-14: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue…
• CVE-2026-89068 - CVSS 9.8 (critical), 2026-10-14: Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
• CVE-2026-89067 - CVSS 8.8 (high), 2026-10-14: Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and…
• CVE-2026-87093 - CVSS 8.8 (high), 2026-10-14: Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from…
• CVE-2026-93695 - CVSS 7.4 (high), 2026-10-12: In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path…
• CVE-2026-93694 - CVSS 4 (medium), 2026-10-12: In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this…
• CVE-2026-93693 - CVSS 6.5 (medium), 2026-10-12: In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response…
• CVE-2026-16137 - CVSS 7.2 (high), 2026-08-17: In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload…
• CVE-2026-16138 - CVSS 8 (high), 2026-08-17: In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write…