Progress Software vulnerabilities, page 3
115 vulnerabilities
Known vulnerabilities in Progress Software products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 39 products.
CVE-2024-4837progress softwaretelerik report server+1
EPSS score0.43%
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.CVE-2024-4357progress softwaretelerik report server+1EPSS score0.70%
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.CVE-2024-7840progress softwaretelerik reporting+1EPSS score0.66%
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.CVE-2024-7575progress softwaretelerik ui for wpf+1EPSS score0.70%
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.CVE-2024-7679progress softwaretelerik ui for winforms+1EPSS score0.74%
In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.CVE-2024-7576progress softwaretelerik ui for wpf+1EPSS score0.46%
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-10095progress softwaretelerik ui for wpf+1EPSS score0.75%
In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-10013progress softwaretelerik ui for winforms+1EPSS score0.22%
In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-10012progress softwaretelerik ui for wpf+1EPSS score0.23%
In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-12251progress softwaretelerik ui for winui+1EPSS score0.52%
In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink elements.CVE-2024-12629progress softwaretelerik kendoreact+1EPSS score0.69%
In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.CVE-2024-8015progress softwaretelerik reporting+1EPSS score0.82%
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.CVE-2024-8048progress softwaretelerik reporting+1EPSS score0.22%
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.CVE-2024-8316progress softwaretelerik ui for wpf+1EPSS score0.25%
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.CVE-2024-8049progress softwaretelerik document processing libraries+1EPSS score0.43%
In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessive processing, leading to excessive use of computing resources leaving the application process unavailable.CVE-2024-8014progress softwaretelerik reporting+1EPSS score0.62%
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.CVE-2026-91140progress softwareautonomous rest connector genai agentsEPSS score1.92%
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.CVE-2026-2513progress softwareflowmon ads+1EPSS score0.17%
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.CVE-2026-2514progress softwareflowmon ads+1EPSS score0.19%
In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.CVE-2026-2737progress softwareflowmon+1EPSS score0.25%
A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.