Progress vulnerabilities
317 vulnerabilities
Known vulnerabilities in Progress products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 82 products.
Products
50 of 82- Whatsup Gold62 vulnerabilities
- Moveit Transfer50 vulnerabilities
- Ws Ftp Server28 vulnerabilities
- Loadmaster27 vulnerabilities
- Sitefinity24 vulnerabilities
- Telerik Ui For Asp.Net Ajax21 vulnerabilities
- Telerik Reporting14 vulnerabilities
- Connection Manager For Objectscale12 vulnerabilities
- Ecs Connection Manager12 vulnerabilities
- Openedge12 vulnerabilities
- Marklogic Server10 vulnerabilities
- Sharefile Storage Zones Controller9 vulnerabilities
- Moveit Automation8 vulnerabilities
- Multi Tenant Loadmaster8 vulnerabilities
- Moveit Web Application Firewall7 vulnerabilities
- Telerik Report Server7 vulnerabilities
- Progress5 vulnerabilities
- Sitefinity Cms5 vulnerabilities
- Flowmon4 vulnerabilities
- Flowmon Anomaly Detection System4 vulnerabilities
- Telerik Document Processing Libraries3 vulnerabilities
- Telerik Ui For Winforms3 vulnerabilities
- Datadirect Connect For JDBC Autonomous REST Connector2 vulnerabilities
- Datadirect Connect For JDBC For Amazon Redshift2 vulnerabilities
- Datadirect Connect For JDBC For Apache Cassandra2 vulnerabilities
- Datadirect Connect For JDBC For Apache Impala2 vulnerabilities
- Datadirect Connect For JDBC For Apache Sparksql2 vulnerabilities
- Datadirect Connect For JDBC For DB22 vulnerabilities
- Datadirect Connect For JDBC For Google Analytics 42 vulnerabilities
- Datadirect Connect For JDBC For Google Bigquery2 vulnerabilities
- Datadirect Connect For JDBC For Greenplum2 vulnerabilities
- Datadirect Connect For JDBC For Hive2 vulnerabilities
- Datadirect Connect For JDBC For Informix2 vulnerabilities
- Datadirect Connect For JDBC For Microsoft Dynamics 3652 vulnerabilities
- Datadirect Connect For JDBC For Microsoft Sharepoint2 vulnerabilities
- Datadirect Connect For JDBC For Microsoft Sqlserver2 vulnerabilities
- Datadirect Connect For JDBC For Mongodb2 vulnerabilities
- Datadirect Connect For JDBC For Mysql2 vulnerabilities
- Datadirect Connect For JDBC For Oracle Database2 vulnerabilities
- Datadirect Connect For JDBC For Oracle Eloqua2 vulnerabilities
- Datadirect Connect For JDBC For Oracle Sales Cloud2 vulnerabilities
- Datadirect Connect For JDBC For Oracle Service Cloud2 vulnerabilities
- Datadirect Connect For JDBC For Postgresql2 vulnerabilities
- Datadirect Connect For JDBC For Progress Openedge2 vulnerabilities
- Datadirect Connect For JDBC For Salesforce2 vulnerabilities
- Datadirect Connect For JDBC For SAP HANA2 vulnerabilities
- Datadirect Connect For JDBC For SAP S/4 HANA2 vulnerabilities
- Datadirect Connect For JDBC For Snowflake2 vulnerabilities
- Datadirect Connect For JDBC For Sybase ASE2 vulnerabilities
- Datadirect Hybrid Data Pipeline Docker2 vulnerabilities
CVE-2026-89077progressmoveit_transfer
EPSS score0.45%
Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89076progressmoveit_transferEPSS score0.48%
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89075progressmoveit_transferEPSS score0.17%
Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89074progressmoveit_transferEPSS score0.45%
Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89073progressmoveit_transferEPSS score0.34%
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89072progressmoveit_transferEPSS score0.23%
Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89071progressmoveit_transferEPSS score0.49%
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89070progressmoveit_transferEPSS score0.39%
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89069progressmoveit_transferEPSS score0.34%
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89068progressmoveit_transferEPSS score0.52%
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-89067progressmoveit_transferEPSS score0.53%
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-87093progressmoveit_transferEPSS score0.14%
Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.
This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.CVE-2026-93694progresssharefile storage zones controllerEPSS score0.07%
In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.CVE-2026-93695progresssharefile storage zones controllerEPSS score0.17%
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.CVE-2026-93693progresssharefile storage zones controllerEPSS score0.24%
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.CVE-2018-14037progresskendo_uiEPSS score1.17%
Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (in the worst case) to take over user sessions.CVE-2018-17056progresssitefinity_cmsEPSS score0.82%
Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-17055progresssitefinityEPSS score0.97%
An arbitrary file upload vulnerability in Progress Sitefinity CMS versions 4.0 through 11.0 related to image uploads.CVE-2018-17053progresssitefinity_cmsEPSS score0.84%
Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17054.CVE-2018-17054progresssitefinity_cmsEPSS score0.84%
Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to login request parameters, a different vulnerability than CVE-2018-17053.