Progress Software - vulnerabilities (CVEs)

125 CVEs in 41 products, 33 in the last 30 days, newest from 2026-10-28.

Products

Telerik Ui For Asp.net Ajax - 19 CVEs
Kendo Ui For Jquery - 15 CVEs
Loadmaster - 15 CVEs
Moveit Waf - 10 CVEs
Object Scale Connection Manager - 10 CVEs
Telerik Document Processing Libraries - 9 CVEs
Flowmon - 7 CVEs
Moveit Automation - 6 CVEs
Ecs Connection Manager - 5 CVEs
Ecs Connections Manager - 5 CVEs
Sitefinity - 5 CVEs
Telerik Report Server - 5 CVEs
Telerik Reporting - 5 CVEs
Telerik Ui For Wpf - 5 CVEs
Flowmon Ads - 4 CVEs
Progress Telerik Fiddler Classic - 4 CVEs
Chef Automate - 3 CVEs
Hybrid Data Pipeline - 2 CVEs
Kendoreact - 2 CVEs
Progress Telerik Fiddler Everywhere - 2 CVEs
Progress Telerik Ui For Wpf Versions - 2 CVEs
Telerik Ui For Winforms - 2 CVEs
Autonomous Rest Connector Genai Agents - 1 CVEs
Chef Inspec - 1 CVEs
Kendo Ui For Angular - 1 CVEs
Kendo Ui For Vue - 1 CVEs
Moveit Transfer - 1 CVEs
Multi Tenant - 1 CVEs
Multi Tenant Loadmaster - 1 CVEs
Progress Telerik Document Processing Libraries - 1 CVEs
Progress Telerik Kendo Ui For Vue - 1 CVEs
Progress Telerik Ui For Winforms - 1 CVEs
Progresssitefinity-nextjs-sdk - 1 CVEs
Telerik Justdecompile - 1 CVEs
Telerik Kendoreact - 1 CVEs
Telerik Test Studio - 1 CVEs
Telerik Ui For Asp.net Core - 1 CVEs
Telerik Ui For Asp.net Mvc - 1 CVEs
Telerik Ui For Blazor - 1 CVEs
Telerik Ui For Winui - 1 CVEs
Ws Ftp Server - 1 CVEs

Newest CVEs of Progress Software

CVE-2026-118037 - CVSS 7.5 (high), 2026-10-28: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and…
CVE-2026-118036 - CVSS 7.5 (high), 2026-10-28: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity…
CVE-2026-118035 - CVSS 7.5 (high), 2026-10-28: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop…
CVE-2026-118040 - CVSS 7.5 (high), 2026-10-28: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate…
CVE-2026-118039 - CVSS 7.5 (high), 2026-10-28: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing…
CVE-2026-118038 - CVSS 7.1 (high), 2026-10-28: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools…
CVE-2026-108116 - CVSS 7.5 (high), 2026-10-15: In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject…
CVE-2026-106153 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title…
CVE-2026-106151 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-*…
CVE-2026-106150 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting…
CVE-2026-106149 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation…
CVE-2026-106148 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted…
CVE-2026-106147 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField…
CVE-2026-106161 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without…
CVE-2026-106160 - CVSS 5.4 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths…
CVE-2026-106159 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an…
CVE-2026-106158 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted…
CVE-2026-106157 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into…
CVE-2026-106162 - CVSS 4.7 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names…
CVE-2026-106163 - CVSS 6.5 (medium), 2026-10-15: In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely…
CVE-2026-106139 - CVSS 5.4 (medium), 2026-10-10: In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted…
CVE-2026-106138 - CVSS 5.4 (medium), 2026-10-10: In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point…
CVE-2026-106155 - CVSS 8.9 (high), 2026-10-09: In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an…
CVE-2026-106145 - CVSS 7.1 (high), 2026-10-09: In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated…
CVE-2026-106164 - CVSS 7.3 (high), 2026-10-07: In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS…
CVE-2026-91140 - CVSS 9.6 (critical), 2026-10-06: An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents…
CVE-2026-92931 - CVSS 8.8 (high), 2026-10-05: CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote…
CVE-2026-77805 - CVSS 7.9 (high), 2026-10-05: In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by…
CVE-2026-77804 - CVSS 6.6 (medium), 2026-10-05: In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the…
CVE-2026-77803 - CVSS 3.6 (low), 2026-10-05: In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request…