{"items":[{"id":"CVE-2026-106128","published":"2026-11-06T17:01:49.968Z","updated":"2026-11-06T20:36:45.487Z","title":"Prototype Pollution in Progress Software Kendo UI for Vue","severity":"MEDIUM","score":4.1,"vendor":"Progress Software","product":"Kendo UI for Vue","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106127","published":"2026-11-06T17:00:48.327Z","updated":"2026-11-06T17:47:16.221Z","title":"Prototype Pollution in Progress Software KendoReact","severity":"MEDIUM","score":4.1,"vendor":"Progress Software","product":"KendoReact","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106144","published":"2026-11-06T16:59:27.141Z","updated":"2026-11-06T17:46:59.786Z","title":"Prototype Pollution in Progress Software Kendo UI for Angular","severity":"MEDIUM","score":4.1,"vendor":"Progress Software","product":"Kendo UI for Angular","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106143","published":"2026-11-06T16:57:34.218Z","updated":"2026-11-06T16:57:34.218Z","title":"Cross-Site Scripting in Progress Software Kendo UI for Vue","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for Vue","kev":false,"epss":0.00133,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106142","published":"2026-11-06T16:56:18.341Z","updated":"2026-11-06T17:46:44.583Z","title":"Cross-Site Scripting in Progress Software KendoReact","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"KendoReact","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106141","published":"2026-11-06T16:54:42.805Z","updated":"2026-11-06T20:37:59.529Z","title":"Cross-Site Scripting in Progress Software Kendo UI for Angular","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for Angular","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106136","published":"2026-11-06T16:52:00.897Z","updated":"2026-11-06T17:46:29.119Z","title":"Cross-Site Scripting in Progress Software KendoReact","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"KendoReact","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106134","published":"2026-11-06T16:49:19.702Z","updated":"2026-11-06T17:46:14.003Z","title":"Cross-Site Scripting in Progress Software KendoReact","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"KendoReact","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106135","published":"2026-11-06T16:47:50.663Z","updated":"2026-11-06T17:45:58.191Z","title":"Cross-Site Scripting in Progress Software Kendo UI for Angular","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for Angular","kev":false,"epss":0.00173,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104656","published":"2026-11-06T16:34:59.574Z","updated":"2026-11-06T17:47:32.742Z","title":"Cross-site Scripting in Progress Telerik Fiddler Everywhere","severity":"HIGH","score":7.3,"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Everywhere","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-104657","published":"2026-11-06T16:33:21.722Z","updated":"2026-11-06T17:47:49.791Z","title":"Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Fiddler Download & Setup Skill","kev":false,"epss":0.00169,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90872","published":"2026-10-29T15:57:24.826Z","updated":"2026-10-30T17:18:24.148Z","title":"Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server","severity":"MEDIUM","score":6.6,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90871","published":"2026-10-29T15:56:34.762Z","updated":"2026-10-30T17:15:33.651Z","title":"Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server","severity":"MEDIUM","score":5.3,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90870","published":"2026-10-29T15:55:43.950Z","updated":"2026-10-30T17:15:05.940Z","title":"Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server","severity":"MEDIUM","score":5.3,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.0027,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90869","published":"2026-10-29T15:54:48.769Z","updated":"2026-10-30T17:14:35.864Z","title":"Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00356,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90868","published":"2026-10-29T15:53:59.315Z","updated":"2026-10-30T17:18:24.284Z","title":"OS Command Injection in Progress WS_FTP Server","severity":"CRITICAL","score":9.9,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.01493,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90867","published":"2026-10-29T15:53:12.203Z","updated":"2026-10-30T17:18:24.424Z","title":"Improper Access Control of Web Admin Console in Progress WS_FTP Server","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00403,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90866","published":"2026-10-29T15:52:24.790Z","updated":"2026-10-30T17:18:24.557Z","title":"Virtual Folder Path Confinement Bypass in Progress WS_FTP Server","severity":"CRITICAL","score":9.1,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.0073,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90865","published":"2026-10-29T15:51:35.058Z","updated":"2026-10-30T17:18:24.861Z","title":"Command Injection via FTP Notification Variables in Progress WS_FTP Server","severity":"CRITICAL","score":9,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.01143,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90864","published":"2026-10-29T15:50:29.084Z","updated":"2026-10-30T17:18:24.999Z","title":"Host Administrator Path Containment Bypass in Progress WS_FTP Server","severity":"CRITICAL","score":9.1,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00479,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90863","published":"2026-10-29T15:49:34.111Z","updated":"2026-10-30T17:18:25.132Z","title":"Privilege Escalation via Missing Authorization in WS_FTP Manager","severity":"CRITICAL","score":9.1,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00656,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90862","published":"2026-10-29T15:48:42.885Z","updated":"2026-10-30T17:14:03.885Z","title":"Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server","severity":"MEDIUM","score":4.3,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00222,"kevAdded":null,"exploit":false},{"id":"CVE-2026-90861","published":"2026-10-29T15:47:45.075Z","updated":"2026-10-30T17:18:25.273Z","title":"Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server","severity":"MEDIUM","score":6.6,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00305,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84296","published":"2026-10-29T15:46:44.924Z","updated":"2026-10-30T17:18:25.411Z","title":"SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server","severity":"MEDIUM","score":6.8,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00339,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84295","published":"2026-10-29T15:45:08.601Z","updated":"2026-10-30T17:18:25.542Z","title":"Improper Authentication in Progress WS_FTP Server","severity":"CRITICAL","score":10,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00553,"kevAdded":null,"exploit":false},{"id":"CVE-2026-84294","published":"2026-10-29T15:42:44.195Z","updated":"2026-11-05T21:24:50.218Z","title":"Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server","severity":"HIGH","score":7.7,"vendor":"Progress Software","product":"WS_FTP Server","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118037","published":"2026-10-28T12:34:09.534Z","updated":"2026-11-06T18:34:28.227Z","title":"Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00274,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118036","published":"2026-10-28T12:33:04.373Z","updated":"2026-11-06T18:34:42.847Z","title":"Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118035","published":"2026-10-28T12:31:56.249Z","updated":"2026-11-06T18:34:57.357Z","title":"Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00292,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118040","published":"2026-10-28T12:30:41.623Z","updated":"2026-11-06T18:35:13.270Z","title":"Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00089,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118039","published":"2026-10-28T12:29:35.667Z","updated":"2026-11-06T18:35:30.683Z","title":"XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00268,"kevAdded":null,"exploit":false},{"id":"CVE-2026-118038","published":"2026-10-28T12:27:47.560Z","updated":"2026-11-06T18:35:46.254Z","title":"Path Traversal in Telerik Document Processing Libraries AI Agent Tools","severity":"HIGH","score":7.1,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00252,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108116","published":"2026-10-15T14:12:52.017Z","updated":"2026-10-15T18:11:50.463Z","title":"MDX and SOAP Injection in Kendo UI for jQuery","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00263,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106153","published":"2026-10-15T14:12:05.941Z","updated":"2026-10-15T18:24:48.793Z","title":"Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106151","published":"2026-10-15T14:11:08.537Z","updated":"2026-10-15T18:12:49.751Z","title":"Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106150","published":"2026-10-15T14:09:50.330Z","updated":"2026-10-15T18:13:16.731Z","title":"Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106149","published":"2026-10-15T14:08:43.628Z","updated":"2026-10-15T18:13:44.008Z","title":"Cross-site Scripting (XSS) in Kendo UI for jQuery Menu","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106148","published":"2026-10-15T13:28:22.551Z","updated":"2026-10-15T18:16:24.215Z","title":"Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106147","published":"2026-10-15T13:27:32.243Z","updated":"2026-10-15T18:08:12.892Z","title":"Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106161","published":"2026-10-15T13:26:57.635Z","updated":"2026-10-15T18:25:52.553Z","title":"Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00178,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106160","published":"2026-10-15T13:24:33.068Z","updated":"2026-10-15T18:26:30.515Z","title":"Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00192,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106159","published":"2026-10-15T13:23:40.132Z","updated":"2026-10-15T18:26:53.924Z","title":"Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery","severity":"MEDIUM","score":4.7,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106158","published":"2026-10-15T13:22:44.197Z","updated":"2026-10-15T18:29:15.316Z","title":"Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery","severity":"MEDIUM","score":4.7,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106157","published":"2026-10-15T13:21:27.532Z","updated":"2026-10-15T18:29:35.947Z","title":"Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery","severity":"MEDIUM","score":4.7,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106162","published":"2026-10-15T13:20:11.331Z","updated":"2026-10-15T18:30:23.198Z","title":"Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery","severity":"MEDIUM","score":4.7,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106163","published":"2026-10-15T13:18:53.367Z","updated":"2026-10-15T18:30:45.142Z","title":"Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser","severity":"MEDIUM","score":6.5,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00181,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89077","published":"2026-10-14T15:16:24.476Z","updated":"2026-10-15T03:56:58.485Z","title":"MOVEit Transfer Identity validation flaw in SFTP authentication","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00463,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89076","published":"2026-10-14T15:15:23.727Z","updated":"2026-10-15T03:57:15.737Z","title":"MOVEit Transfer SQL injection in custom reporting","severity":"HIGH","score":7.2,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00519,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89075","published":"2026-10-14T15:14:28.783Z","updated":"2026-10-15T03:57:13.913Z","title":"MOVEit Transfer Local Disclosure of Session Information Vulnerability","severity":"HIGH","score":7.3,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.0018,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89074","published":"2026-10-14T15:12:49.542Z","updated":"2026-10-15T03:57:12.922Z","title":"MOVEit Transfer Email MFA Bypass","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00482,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89073","published":"2026-10-14T15:11:30.720Z","updated":"2026-10-15T10:31:14.384Z","title":"MOVEit Transfer Access restriction bypass in OAuth authentication","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.004,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89072","published":"2026-10-14T15:10:40.581Z","updated":"2026-10-15T10:31:14.513Z","title":"MOVEit Transfer Authorization Flaw in Certificate Management","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00249,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89071","published":"2026-10-14T15:09:45.282Z","updated":"2026-10-15T10:31:14.648Z","title":"MOVEit Transfer LDAP injection in certificate-based authentication","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00521,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89070","published":"2026-10-14T15:08:46.009Z","updated":"2026-10-15T10:31:14.784Z","title":"MOVEit Transfer OIDC Authentication Replay Vulnerability","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.0044,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89069","published":"2026-10-14T15:07:00.959Z","updated":"2026-10-16T15:31:52.383Z","title":"MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages","severity":"HIGH","score":8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00438,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89068","published":"2026-10-14T15:06:13.886Z","updated":"2026-10-15T10:31:14.912Z","title":"MOVEit Transfer Authentication bypass in LDAP sign-on","severity":"HIGH","score":8.1,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00536,"kevAdded":null,"exploit":false},{"id":"CVE-2026-89067","published":"2026-10-14T15:05:26.675Z","updated":"2026-10-15T10:31:15.047Z","title":"MOVEit Transfer Secure Messaging Authentication Bypass","severity":"HIGH","score":8.8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00529,"kevAdded":null,"exploit":false},{"id":"CVE-2026-87093","published":"2026-10-14T15:04:16.517Z","updated":"2026-10-15T10:31:15.286Z","title":"MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation","severity":"HIGH","score":8.8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00158,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85976","published":"2026-10-12T16:56:54.035Z","updated":"2026-10-16T17:19:45.401Z","title":"HTTP response splitting in Progress MarkLogic Server Query Console","severity":"MEDIUM","score":5.4,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00139,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85975","published":"2026-10-12T16:52:30.645Z","updated":"2026-10-15T18:05:03.476Z","title":"Cleartext transmission in Progress MarkLogic Server Amazon S3 connections","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00234,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85974","published":"2026-10-12T16:50:49.589Z","updated":"2026-10-14T10:51:05.977Z","title":"Improper TLS hostname verification in Progress MarkLogic Server","severity":"HIGH","score":7.4,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85973","published":"2026-10-12T16:49:57.365Z","updated":"2026-10-14T10:51:06.098Z","title":"Cleartext transmission in Progress MarkLogic Server cluster join operations","severity":"HIGH","score":7.4,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00143,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85972","published":"2026-10-12T16:41:15.952Z","updated":"2026-10-14T10:51:06.225Z","title":"Improper Kerberos server verification in Progress MarkLogic Server","severity":"HIGH","score":7.4,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00324,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85971","published":"2026-10-12T16:40:22.155Z","updated":"2026-10-14T10:51:06.341Z","title":"Incorrect log file permissions in Progress MarkLogic Server","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00103,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85970","published":"2026-10-12T16:39:27.145Z","updated":"2026-10-15T19:14:58.928Z","title":"Improper XML external entity restriction in Progress MarkLogic Server","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85969","published":"2026-10-12T16:37:54.756Z","updated":"2026-10-15T19:14:59.110Z","title":"Out-of-bounds write in Progress MarkLogic Server","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00244,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85968","published":"2026-10-12T16:37:16.513Z","updated":"2026-10-15T19:14:59.252Z","title":"Out-of-bounds read in Progress MarkLogic Server","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85967","published":"2026-10-12T16:32:39.701Z","updated":"2026-10-15T19:14:59.396Z","title":"Cross-site scripting in Progress MarkLogic Server","severity":"MEDIUM","score":6.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00197,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85966","published":"2026-10-12T16:31:32.011Z","updated":"2026-10-15T18:05:20.205Z","title":"Exposure of sensitive information in Progress MarkLogic Server","severity":"HIGH","score":7.7,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00296,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85965","published":"2026-10-12T16:30:00.120Z","updated":"2026-10-15T18:05:30.987Z","title":"Use-after-free in Progress MarkLogic Server JavaScript engine integration","severity":"HIGH","score":8,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85964","published":"2026-10-12T16:29:18.206Z","updated":"2026-10-15T18:05:42.014Z","title":"Path traversal in Progress MarkLogic Server Query Console","severity":"HIGH","score":7.7,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00491,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85963","published":"2026-10-12T16:28:11.381Z","updated":"2026-10-15T18:05:49.934Z","title":"Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00426,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85962","published":"2026-10-12T16:12:26.825Z","updated":"2026-10-15T18:06:02.073Z","title":"Improper authentication in Progress MarkLogic Server SAML processing","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00313,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85961","published":"2026-10-12T16:10:53.442Z","updated":"2026-10-15T18:06:13.280Z","title":"Sensitive information exposure in Progress MarkLogic Server Azure deployments","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00499,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85960","published":"2026-10-12T16:09:50.674Z","updated":"2026-10-14T10:51:06.456Z","title":"Cross-site request forgery in Progress MarkLogic Server Query Console","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.0019,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85959","published":"2026-10-12T16:08:48.107Z","updated":"2026-10-15T18:06:20.986Z","title":"Insufficient authentication logging in Progress MarkLogic Server","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00397,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85958","published":"2026-10-12T16:02:09.038Z","updated":"2026-10-15T18:06:29.079Z","title":"Improper OAuth token validation in Progress MarkLogic Server","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00365,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85957","published":"2026-10-12T16:01:34.049Z","updated":"2026-10-16T17:19:55.107Z","title":"Improper XML external entity restriction in Progress MarkLogic Server SAML processing","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00402,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85956","published":"2026-10-12T16:00:29.400Z","updated":"2026-10-14T10:51:06.580Z","title":"Improper privilege management in Progress MarkLogic Server backup and restore operations","severity":"CRITICAL","score":9.6,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00396,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85955","published":"2026-10-12T15:59:28.496Z","updated":"2026-10-14T10:51:06.699Z","title":"Improper privilege management in Progress MarkLogic Server xdmp:eval-in","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00573,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85954","published":"2026-10-12T15:58:40.360Z","updated":"2026-10-14T10:51:06.821Z","title":"Improper privilege management in Progress MarkLogic Server higher-order XQuery functions","severity":"HIGH","score":8.6,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85953","published":"2026-10-12T15:58:02.995Z","updated":"2026-10-15T18:06:41.738Z","title":"Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio","severity":"HIGH","score":8.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85952","published":"2026-10-12T15:55:41.435Z","updated":"2026-10-15T19:14:59.518Z","title":"Server-side request forgery in Progress MarkLogic Server Linux cloud deployments","severity":"HIGH","score":8.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00249,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85951","published":"2026-10-12T15:54:35.663Z","updated":"2026-10-15T19:14:59.642Z","title":"Server-side request forgery in Progress MarkLogic Server Azure deployments","severity":"HIGH","score":8.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00249,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85950","published":"2026-10-12T15:42:22.190Z","updated":"2026-10-14T10:51:07.490Z","title":"Improper privilege management in Progress MarkLogic Server REST extensions","severity":"HIGH","score":8.4,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85949","published":"2026-10-12T15:36:31.613Z","updated":"2026-10-16T17:40:16.383Z","title":"Sensitive information exposure in Progress MarkLogic Server trace logs","severity":"HIGH","score":8.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00317,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85948","published":"2026-10-12T15:35:05.124Z","updated":"2026-10-14T10:51:07.611Z","title":"Improper privilege management in Progress MarkLogic Server Management API","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85947","published":"2026-10-12T15:34:01.239Z","updated":"2026-10-14T10:51:07.728Z","title":"Improper privilege management in Progress MarkLogic Server forest operations","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00449,"kevAdded":null,"exploit":false},{"id":"CVE-2026-9191","published":"2026-10-12T15:32:46.475Z","updated":"2026-10-14T10:51:07.851Z","title":"Insufficient isolation of user-supplied code in Progress MarkLogic Server","severity":"CRITICAL","score":9.6,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93695","published":"2026-10-12T12:52:15.973Z","updated":"2026-10-13T03:55:27.886Z","title":"Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService","severity":"HIGH","score":7.4,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00171,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93694","published":"2026-10-12T12:50:22.621Z","updated":"2026-10-12T14:43:50.913Z","title":"Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller","severity":"MEDIUM","score":4,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00072,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93693","published":"2026-10-12T12:48:53.652Z","updated":"2026-10-12T14:43:38.793Z","title":"Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller","severity":"MEDIUM","score":6.5,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.0024,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106139","published":"2026-10-10T09:23:48.755Z","updated":"2026-10-15T18:18:16.714Z","title":"Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for Vue","kev":false,"epss":0.00133,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106138","published":"2026-10-10T09:23:05.665Z","updated":"2026-10-15T18:17:56.079Z","title":"Cross-Site Scripting via Chart Tooltip in KendoReact","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"KendoReact","kev":false,"epss":0.00133,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106155","published":"2026-10-09T07:07:57.817Z","updated":"2026-10-09T18:03:02.317Z","title":"Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers","severity":"HIGH","score":8.9,"vendor":"Progress Software","product":"Telerik Report Server","kev":false,"epss":0.00199,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106145","published":"2026-10-09T07:03:34.351Z","updated":"2026-10-09T18:03:22.258Z","title":"Privilege Escalation in Telerik Report Server Service-Agent Hub","severity":"HIGH","score":7.1,"vendor":"Progress Software","product":"Telerik Report Server","kev":false,"epss":0.00145,"kevAdded":null,"exploit":false},{"id":"CVE-2026-106164","published":"2026-10-07T18:02:32.641Z","updated":"2026-10-07T19:23:45.883Z","title":"Infinite Loop in Telerik Document Processing XLS Import","severity":"HIGH","score":7.3,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00186,"kevAdded":null,"exploit":false},{"id":"CVE-2026-91140","published":"2026-10-06T13:46:11.357Z","updated":"2026-10-07T03:55:20.033Z","title":"OS command injection in Progress Software Autonomous REST Connector GenAI Agents","severity":"CRITICAL","score":9.6,"vendor":"Progress Software","product":"Autonomous REST Connector GenAI Agents","kev":false,"epss":0.02046,"kevAdded":null,"exploit":false},{"id":"CVE-2026-92931","published":"2026-10-05T13:06:02.081Z","updated":"2026-10-06T17:48:45.628Z","title":"CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"@progress/sitefinity-nextjs-sdk","kev":false,"epss":0.00263,"kevAdded":null,"exploit":false},{"id":"CVE-2026-77805","published":"2026-10-05T12:40:57.524Z","updated":"2026-10-05T15:26:04.778Z","title":"Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic","severity":"HIGH","score":7.9,"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","kev":false,"epss":0.00068,"kevAdded":null,"exploit":false},{"id":"CVE-2026-77804","published":"2026-10-05T12:40:26.811Z","updated":"2026-10-06T17:49:23.338Z","title":"Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic","severity":"MEDIUM","score":6.6,"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","kev":false,"epss":0.00066,"kevAdded":null,"exploit":false},{"id":"CVE-2026-77803","published":"2026-10-05T12:39:36.806Z","updated":"2026-10-06T17:50:34.935Z","title":"Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic","severity":"LOW","score":3.6,"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","kev":false,"epss":0.00097,"kevAdded":null,"exploit":false},{"id":"CVE-2026-77802","published":"2026-10-05T12:38:58.912Z","updated":"2026-10-06T17:51:15.128Z","title":"HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic","severity":"MEDIUM","score":6.3,"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Classic","kev":false,"epss":0.00103,"kevAdded":null,"exploit":false},{"id":"CVE-2026-86158","published":"2026-09-29T06:34:24.264Z","updated":"2026-09-30T15:28:20.211Z","title":"Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere","severity":"HIGH","score":7.7,"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Everywhere","kev":false,"epss":0.00087,"kevAdded":null,"exploit":false},{"id":"CVE-2026-86157","published":"2026-09-29T06:34:17.555Z","updated":"2026-09-30T15:28:20.346Z","title":"Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere","severity":"MEDIUM","score":5.6,"vendor":"Progress Software","product":"Progress® Telerik® Fiddler® Everywhere","kev":false,"epss":0.00119,"kevAdded":null,"exploit":false},{"id":"CVE-2026-80462","published":"2026-09-11T12:28:49.216Z","updated":"2026-09-18T12:04:29.296Z","title":"Privilege Escalation in Progress Chef Automate","severity":"CRITICAL","score":10,"vendor":"Progress Software","product":"Chef Automate","kev":false,"epss":0.02006,"kevAdded":null,"exploit":false},{"id":"CVE-2026-19219","published":"2026-09-02T10:35:51.840Z","updated":"2026-09-03T03:56:09.596Z","title":"DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00209,"kevAdded":null,"exploit":false},{"id":"CVE-2026-18672","published":"2026-09-02T10:31:43.100Z","updated":"2026-09-02T10:42:56.527Z","title":"RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00503,"kevAdded":null,"exploit":false},{"id":"CVE-2026-16137","published":"2026-08-17T13:32:45.100Z","updated":"2026-08-18T03:55:24.727Z","title":"Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller","severity":"HIGH","score":7.2,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00743,"kevAdded":null,"exploit":false},{"id":"CVE-2026-16138","published":"2026-08-17T13:32:01.432Z","updated":"2026-08-18T03:55:25.792Z","title":"Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service","severity":"HIGH","score":8,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00828,"kevAdded":null,"exploit":false},{"id":"CVE-2026-16139","published":"2026-08-17T13:31:14.597Z","updated":"2026-08-18T03:55:26.857Z","title":"Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution","severity":"HIGH","score":7.2,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00935,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65941","published":"2026-08-12T15:23:54.118Z","updated":"2026-11-06T19:51:00.879Z","title":"WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00677,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65940","published":"2026-08-12T15:23:27.963Z","updated":"2026-08-12T16:11:10.232Z","title":"WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.","severity":"MEDIUM","score":6.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00352,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65939","published":"2026-08-12T15:23:07.490Z","updated":"2026-08-13T03:55:48.167Z","title":"WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.","severity":"MEDIUM","score":6.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00379,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65938","published":"2026-08-12T15:22:44.387Z","updated":"2026-08-12T17:06:42.725Z","title":"WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.","severity":"MEDIUM","score":4.3,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00253,"kevAdded":null,"exploit":false},{"id":"CVE-2026-65937","published":"2026-08-12T15:21:55.475Z","updated":"2026-08-13T03:55:49.361Z","title":"WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI","severity":"HIGH","score":8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00411,"kevAdded":null,"exploit":false},{"id":"CVE-2026-9203","published":"2026-08-05T15:40:19.062Z","updated":"2026-08-07T03:55:33.648Z","title":"Server-side request forgery in Progress MarkLogic Server","severity":"HIGH","score":8.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00341,"kevAdded":null,"exploit":false},{"id":"CVE-2026-9195","published":"2026-08-05T15:38:11.084Z","updated":"2026-08-05T18:41:44.856Z","title":"Cross-site scripting in Progress MarkLogic Server Query Console","severity":"CRITICAL","score":9.3,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00654,"kevAdded":null,"exploit":false},{"id":"CVE-2026-9193","published":"2026-08-05T15:37:07.686Z","updated":"2026-08-07T03:55:32.271Z","title":"Privilege escalation in Progress MarkLogic Server Hadoop integration","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00463,"kevAdded":null,"exploit":false},{"id":"CVE-2026-9192","published":"2026-08-05T15:35:53.560Z","updated":"2026-08-07T03:55:30.843Z","title":"Authentication bypass in Progress MarkLogic Server ODBC App Server","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00835,"kevAdded":null,"exploit":false},{"id":"CVE-2026-9190","published":"2026-08-05T15:34:58.636Z","updated":"2026-08-07T03:55:28.510Z","title":"HTTP request smuggling in Progress MarkLogic Server","severity":"CRITICAL","score":9.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00737,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8709","published":"2026-08-05T15:33:47.701Z","updated":"2026-08-07T03:55:27.427Z","title":"Privilege escalation in Progress MarkLogic Server REST document patch operation","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00463,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7557","published":"2026-08-05T15:33:05.872Z","updated":"2026-08-07T03:55:26.318Z","title":"SAML authentication bypass in Progress MarkLogic Server","severity":"CRITICAL","score":9.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00462,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7329","published":"2026-08-05T15:32:21.684Z","updated":"2026-08-07T03:55:25.230Z","title":"Privilege escalation in Progress MarkLogic Server REST query interfaces","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00571,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7327","published":"2026-08-05T15:30:40.887Z","updated":"2026-08-07T03:55:24.168Z","title":"Privilege escalation in Progress MarkLogic Server REST API document processing","severity":"HIGH","score":8.1,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00393,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7326","published":"2026-08-05T15:29:54.603Z","updated":"2026-08-07T03:55:23.079Z","title":"Cross-site request forgery in Progress MarkLogic Server Admin UI","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"MarkLogic Server","kev":false,"epss":0.00214,"kevAdded":null,"exploit":false},{"id":"CVE-2026-59690","published":"2026-07-27T12:26:27.980Z","updated":"2026-07-28T03:55:33.063Z","title":"Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API","severity":"HIGH","score":8,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.00257,"kevAdded":null,"exploit":false},{"id":"CVE-2026-59689","published":"2026-07-27T12:25:22.245Z","updated":"2026-07-28T03:55:34.119Z","title":"Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF Improper Authorization Allows Privilege Escalation to Root","severity":"HIGH","score":8,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.00257,"kevAdded":null,"exploit":false},{"id":"CVE-2026-59688","published":"2026-07-27T12:24:23.139Z","updated":"2026-07-28T03:55:34.913Z","title":"Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Backup Restore Functionality","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.01677,"kevAdded":null,"exploit":false},{"id":"CVE-2026-59687","published":"2026-07-27T12:23:15.683Z","updated":"2026-07-28T03:55:35.706Z","title":"Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Geo Location Management Interface","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.01677,"kevAdded":null,"exploit":false},{"id":"CVE-2026-59686","published":"2026-07-27T12:22:05.699Z","updated":"2026-07-28T03:55:37.387Z","title":"Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF OS Command Injection via Management Interface","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.01677,"kevAdded":null,"exploit":false},{"id":"CVE-2026-15968","published":"2026-07-23T20:01:13.408Z","updated":"2026-07-24T13:32:48.089Z","title":"Stored XSS vulnerability in MOVEit Transfer","severity":"HIGH","score":7.1,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00332,"kevAdded":null,"exploit":false},{"id":"CVE-2026-15967","published":"2026-07-23T19:59:33.949Z","updated":"2026-07-25T03:55:22.642Z","title":"MOVEit Transfer refresh-token processing does not enforce updated account restrictions","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00373,"kevAdded":null,"exploit":false},{"id":"CVE-2026-15966","published":"2026-07-23T19:58:01.659Z","updated":"2026-07-25T03:55:21.850Z","title":"Improper CORS handling in MOVEit Transfer","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00373,"kevAdded":null,"exploit":false},{"id":"CVE-2026-10697","published":"2026-07-23T19:54:48.304Z","updated":"2026-07-25T03:55:21.025Z","title":"MFA Bypass in MOVEit Transfer","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00596,"kevAdded":null,"exploit":false},{"id":"CVE-2026-14932","published":"2026-07-22T13:46:45.714Z","updated":"2026-07-22T19:09:34.640Z","title":"Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart","severity":"MEDIUM","score":6.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00353,"kevAdded":null,"exploit":false},{"id":"CVE-2026-14865","published":"2026-07-22T13:45:21.227Z","updated":"2026-07-22T19:10:08.695Z","title":"XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX","severity":"MEDIUM","score":5.3,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00432,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13192","published":"2026-07-22T13:44:14.027Z","updated":"2026-07-22T19:10:33.166Z","title":"RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX","severity":"MEDIUM","score":6.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00419,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13190","published":"2026-07-22T13:43:12.374Z","updated":"2026-07-24T03:56:04.216Z","title":"PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00504,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13189","published":"2026-07-22T13:42:19.375Z","updated":"2026-07-22T19:11:54.445Z","title":"SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00361,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13188","published":"2026-07-22T13:41:29.942Z","updated":"2026-07-22T19:12:15.521Z","title":"DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX","severity":"MEDIUM","score":5.9,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00156,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13187","published":"2026-07-22T13:40:21.443Z","updated":"2026-07-24T03:56:03.170Z","title":"DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00341,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13186","published":"2026-07-22T13:39:14.908Z","updated":"2026-07-24T03:56:01.638Z","title":"AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00732,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13185","published":"2026-07-22T13:38:17.195Z","updated":"2026-07-24T03:56:00.738Z","title":"PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00667,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13184","published":"2026-07-22T13:37:11.804Z","updated":"2026-07-22T19:14:27.027Z","title":"RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00306,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13183","published":"2026-07-22T13:36:08.274Z","updated":"2026-07-22T19:15:06.321Z","title":"RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00498,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13182","published":"2026-07-22T13:34:57.272Z","updated":"2026-07-22T19:14:47.505Z","title":"RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00498,"kevAdded":null,"exploit":false},{"id":"CVE-2026-13181","published":"2026-07-22T13:33:18.348Z","updated":"2026-07-24T03:55:59.737Z","title":"RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00732,"kevAdded":null,"exploit":false},{"id":"CVE-2026-15724","published":"2026-07-21T16:55:34.486Z","updated":"2026-07-24T03:55:48.821Z","title":"Path traversal in Progress ShareFile Storage Zones Controller (SZC)","severity":"HIGH","score":8.7,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00524,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8801","published":"2026-07-08T19:56:03.468Z","updated":"2026-07-09T13:36:42.815Z","title":"File Extension Restriction Bypass in MOVEit Transfer","severity":"LOW","score":3.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00546,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8800","published":"2026-07-08T19:53:30.984Z","updated":"2026-07-09T13:35:24.535Z","title":"Cross-Org External Token Metadata accessible to AuditUser role","severity":"LOW","score":2.7,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.0037,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8651","published":"2026-07-08T19:50:43.060Z","updated":"2026-07-09T13:32:24.568Z","title":"IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer","severity":"LOW","score":3.7,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00366,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8650","published":"2026-07-08T19:47:25.636Z","updated":"2026-07-09T13:31:57.971Z","title":"Authenticated Path Traversal allows MOVEit admins to view arbitrary system files","severity":"MEDIUM","score":4.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00601,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8649","published":"2026-07-08T19:41:40.969Z","updated":"2026-07-09T13:29:22.928Z","title":"Institution scope bypass vulnerability in custom reports","severity":"MEDIUM","score":6.4,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00463,"kevAdded":null,"exploit":false},{"id":"CVE-2026-11903","published":"2026-07-08T14:19:16.759Z","updated":"2026-07-09T03:55:41.919Z","title":"Stored XSS in MOVEit Transfer Ad Hoc module","severity":"HIGH","score":8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00408,"kevAdded":null,"exploit":false},{"id":"CVE-2026-10699","published":"2026-07-08T14:18:00.255Z","updated":"2026-07-08T15:09:09.431Z","title":"Memory leak in SFTP service can result in a denial of service in MOVEit Transfer","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00494,"kevAdded":null,"exploit":false},{"id":"CVE-2026-10698","published":"2026-07-08T14:16:25.696Z","updated":"2026-07-09T03:55:42.859Z","title":"Table scope bypass vulnerability in custom reports","severity":"HIGH","score":7.2,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00644,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8079","published":"2026-07-02T14:03:36.018Z","updated":"2026-07-03T03:56:03.186Z","title":"Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon","severity":"HIGH","score":8.7,"vendor":"Progress Software","product":"Flowmon","kev":false,"epss":0.00323,"kevAdded":null,"exploit":false},{"id":"CVE-2026-9272","published":"2026-07-02T14:02:51.273Z","updated":"2026-07-03T03:56:00.966Z","title":"Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS","severity":"HIGH","score":8.7,"vendor":"Progress Software","product":"Flowmon ADS","kev":false,"epss":0.0043,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8668","published":"2026-06-18T21:19:18.848Z","updated":"2026-06-22T18:23:03.280Z","title":"Hardcoded credentials in embedded content","severity":"LOW","score":2.3,"vendor":"Progress Chef","product":"Chef360","kev":false,"epss":0.00271,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8100","published":"2026-06-18T21:18:27.689Z","updated":"2026-06-22T18:11:30.582Z","title":"Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue…","severity":"HIGH","score":8.6,"vendor":"Progress Chef","product":"Chef360","kev":false,"epss":0.00549,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8037","published":"2026-06-04T13:13:45.793Z","updated":"2026-10-15T13:20:45.089Z","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF","severity":"CRITICAL","score":9.6,"vendor":"Progress Software","product":"LoadMaster","kev":true,"epss":0.99794,"kevAdded":"2026-08-07","exploit":true},{"id":"CVE-2026-7313","published":"2026-06-02T13:09:46.916Z","updated":"2026-06-03T03:55:41.806Z","title":"CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity","severity":"HIGH","score":8.7,"vendor":"Progress Software","product":"Sitefinity","kev":false,"epss":0.00319,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7312","published":"2026-06-02T13:09:06.250Z","updated":"2026-11-03T22:13:31.764Z","title":"CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity","severity":"CRITICAL","score":10,"vendor":"Progress Software","product":"Sitefinity","kev":false,"epss":0.00441,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7201","published":"2026-06-02T13:07:36.875Z","updated":"2026-06-02T15:12:26.494Z","title":"CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"Sitefinity","kev":false,"epss":0.00348,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7198","published":"2026-06-02T13:06:32.425Z","updated":"2026-06-03T03:55:44.089Z","title":"CWE-284: Improper Access Control in web services in Progress Sitefinity","severity":"CRITICAL","score":9.8,"vendor":"Progress Software","product":"Sitefinity","kev":false,"epss":0.00443,"kevAdded":null,"exploit":false},{"id":"CVE-2026-7195","published":"2026-06-02T13:04:40.341Z","updated":"2026-06-04T03:55:42.274Z","title":"CWE-20: Improper Input Validation in web services in Progress Sitefinity","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"Sitefinity","kev":false,"epss":0.00433,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8488","published":"2026-05-20T14:14:54.861Z","updated":"2026-05-20T15:29:52.391Z","title":"Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation","severity":"MEDIUM","score":4.3,"vendor":"Progress Software","product":"MOVEit Automation","kev":false,"epss":0.00364,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8487","published":"2026-05-20T14:12:03.406Z","updated":"2026-05-20T15:30:11.664Z","title":"Incorrect default permissions vulnerability in Progress Software MOVEit Automation","severity":"MEDIUM","score":6.5,"vendor":"Progress Software","product":"MOVEit Automation","kev":false,"epss":0.0028,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8486","published":"2026-05-20T14:11:30.771Z","updated":"2026-05-20T15:30:29.106Z","title":"Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation","severity":"MEDIUM","score":5.3,"vendor":"Progress Software","product":"MOVEit Automation","kev":false,"epss":0.00395,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8485","published":"2026-05-20T14:06:57.546Z","updated":"2026-05-20T14:24:51.862Z","title":"Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation","severity":"MEDIUM","score":5.9,"vendor":"Progress Software","product":"MOVEit Automation","kev":false,"epss":0.00348,"kevAdded":null,"exploit":false},{"id":"CVE-2026-5174","published":"2026-04-30T15:07:21.589Z","updated":"2026-05-01T15:24:46.453Z","title":"Improper Access Control Vulnerability in Progress MOVEit Automation","severity":"HIGH","score":7.7,"vendor":"Progress Software","product":"MOVEit Automation","kev":false,"epss":0.03321,"kevAdded":null,"exploit":false},{"id":"CVE-2026-4670","published":"2026-04-30T15:06:11.600Z","updated":"2026-05-01T03:55:57.784Z","title":"Improper Authentication vulnerability in Progress MOVEit Automation","severity":"CRITICAL","score":9.8,"vendor":"Progress Software","product":"MOVEit Automation","kev":false,"epss":0.0504,"kevAdded":null,"exploit":false},{"id":"CVE-2026-6023","published":"2026-04-22T07:13:07.933Z","updated":"2026-04-23T03:56:12.523Z","title":"Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.0054,"kevAdded":null,"exploit":false},{"id":"CVE-2026-6022","published":"2026-04-22T07:07:30.795Z","updated":"2026-04-22T12:28:18.218Z","title":"Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2026-4048","published":"2026-04-20T13:36:49.475Z","updated":"2026-04-22T03:55:54.495Z","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.02132,"kevAdded":null,"exploit":false},{"id":"CVE-2026-3519","published":"2026-04-20T13:32:50.259Z","updated":"2026-04-22T03:55:53.355Z","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.02134,"kevAdded":null,"exploit":false},{"id":"CVE-2026-3518","published":"2026-04-20T13:29:33.794Z","updated":"2026-04-22T03:55:52.242Z","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.16877,"kevAdded":null,"exploit":false},{"id":"CVE-2026-3517","published":"2026-04-20T13:22:54.867Z","updated":"2026-04-22T03:55:51.123Z","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.15488,"kevAdded":null,"exploit":false},{"id":"CVE-2025-8095","published":"2026-04-14T13:13:43.739Z","updated":"2026-04-15T03:58:13.601Z","title":"Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge","severity":"CRITICAL","score":9.1,"vendor":"Progress Software Corporation","product":"OpenEdge","kev":false,"epss":0.00216,"kevAdded":null,"exploit":false},{"id":"CVE-2025-7389","published":"2026-04-14T13:12:54.559Z","updated":"2026-04-14T14:04:52.165Z","title":"Unauthorized Arbitrary File Read via RMI in AdminServer Interface","severity":"HIGH","score":8.2,"vendor":"Progress Software Corporation","product":"OpenEdge","kev":false,"epss":0.00326,"kevAdded":null,"exploit":false},{"id":"CVE-2026-2737","published":"2026-04-02T13:28:41.825Z","updated":"2026-04-03T03:55:29.158Z","title":"Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application","severity":"HIGH","score":8.5,"vendor":"Progress Software","product":"Flowmon","kev":false,"epss":0.00199,"kevAdded":null,"exploit":false},{"id":"CVE-2026-3692","published":"2026-04-02T13:27:45.684Z","updated":"2026-04-03T03:55:27.668Z","title":"Unintended command execution during report generation in Progress Flowmon","severity":"HIGH","score":8.7,"vendor":"Progress Software","product":"Flowmon","kev":false,"epss":0.00428,"kevAdded":null,"exploit":false},{"id":"CVE-2026-2701","published":"2026-04-02T13:04:38.554Z","updated":"2026-04-03T03:55:26.174Z","title":"RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)","severity":"CRITICAL","score":9.1,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.54539,"kevAdded":null,"exploit":false},{"id":"CVE-2026-2699","published":"2026-04-02T13:04:00.485Z","updated":"2026-04-08T15:25:21.185Z","title":"EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)","severity":"CRITICAL","score":9.8,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.58386,"kevAdded":null,"exploit":true},{"id":"CVE-2026-2514","published":"2026-03-12T13:00:27.353Z","updated":"2026-03-13T03:55:43.039Z","title":"Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application","severity":"HIGH","score":8.6,"vendor":"Progress Software","product":"Flowmon ADS","kev":false,"epss":0.00203,"kevAdded":null,"exploit":false},{"id":"CVE-2026-2513","published":"2026-03-12T12:58:59.894Z","updated":"2026-03-13T03:55:42.297Z","title":"Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon ADS web application","severity":"HIGH","score":8.6,"vendor":"Progress Software","product":"Flowmon ADS","kev":false,"epss":0.00192,"kevAdded":null,"exploit":false},{"id":"CVE-2026-2878","published":"2026-02-25T14:45:11.142Z","updated":"2026-02-27T17:06:16.616Z","title":"Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX","severity":"MEDIUM","score":5.3,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.00211,"kevAdded":null,"exploit":false},{"id":"CVE-2025-6723","published":"2026-01-30T14:09:41.182Z","updated":"2026-03-11T14:30:44.870Z","title":"Untrusted user data can lead to privilege escalation","severity":"MEDIUM","score":5.8,"vendor":"Progress Software","product":"Chef Inspec","kev":false,"epss":0.00132,"kevAdded":null,"exploit":false},{"id":"CVE-2025-13447","published":"2026-01-13T14:31:56.911Z","updated":"2026-02-26T15:04:45.811Z","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.27217,"kevAdded":null,"exploit":false},{"id":"CVE-2025-13444","published":"2026-01-13T14:26:50.661Z","updated":"2026-02-26T15:04:46.116Z","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.27217,"kevAdded":null,"exploit":false},{"id":"CVE-2025-13774","published":"2026-01-13T12:59:51.775Z","updated":"2026-02-26T15:04:47.323Z","title":"SQL injection leading to privilege escalation in Progress Flowmon ADS","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"Flowmon ADS","kev":false,"epss":0.0046,"kevAdded":null,"exploit":false},{"id":"CVE-2025-11235","published":"2026-01-06T22:16:48.036Z","updated":"2026-01-07T16:25:41.732Z","title":"MOVEit Transfer REST API does not require current password in order to initiate the password change process","severity":"LOW","score":3.7,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00213,"kevAdded":null,"exploit":false},{"id":"CVE-2025-13147","published":"2025-11-19T20:45:48.418Z","updated":"2025-11-19T20:50:10.151Z","title":"External Service Interaction (DNS)","severity":"MEDIUM","score":5.3,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00288,"kevAdded":null,"exploit":false},{"id":"CVE-2025-10703","published":"2025-11-19T15:47:07.908Z","updated":"2026-11-04T00:13:43.168Z","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC…","severity":"HIGH","score":8.6,"vendor":"Progress","product":"DataDirect Connect for JDBC for Amazon Redshift","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2025-10702","published":"2025-11-19T15:46:26.699Z","updated":"2026-11-04T00:13:28.776Z","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC…","severity":"HIGH","score":8.6,"vendor":"Progress","product":"DataDirect Connect for JDBC for Amazon Redshift","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2025-11906","published":"2025-10-30T07:39:38.530Z","updated":"2026-02-26T16:56:53.026Z","title":"Privilege escalation via writable configuration files in Progress Flowmon","severity":"MEDIUM","score":6.7,"vendor":"Progress Software","product":"Flowmon","kev":false,"epss":0.00138,"kevAdded":null,"exploit":false},{"id":"CVE-2025-10932","published":"2025-10-29T14:12:33.439Z","updated":"2025-10-29T14:33:14.601Z","title":"AS2 module allows uncontrolled file uploads","severity":"HIGH","score":8.2,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00483,"kevAdded":null,"exploit":false},{"id":"CVE-2025-10240","published":"2025-10-09T12:43:40.906Z","updated":"2026-02-26T17:47:58.397Z","title":"Possibility of unintended actions when a user clicks a malicious link in the Progress Flowmon web application","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"Flowmon","kev":false,"epss":0.00321,"kevAdded":null,"exploit":false},{"id":"CVE-2025-10239","published":"2025-10-09T12:42:05.557Z","updated":"2026-02-26T17:47:58.934Z","title":"Unintended command execution via troubleshooting scripts in Progress Flowmon","severity":"HIGH","score":7.2,"vendor":"Progress Software","product":"Flowmon","kev":false,"epss":0.00382,"kevAdded":null,"exploit":false},{"id":"CVE-2025-8868","published":"2025-09-29T11:29:50.463Z","updated":"2025-09-29T12:55:02.884Z","title":"Chef Automate compliance service SQL Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software","product":"Chef Automate","kev":false,"epss":0.27849,"kevAdded":null,"exploit":false},{"id":"CVE-2025-6724","published":"2025-09-29T11:29:42.695Z","updated":"2025-09-29T13:02:01.775Z","title":"Chef Automate SQL Injection Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"Chef Automate","kev":false,"epss":0.00375,"kevAdded":null,"exploit":false},{"id":"CVE-2025-7388","published":"2025-09-04T13:01:13.624Z","updated":"2026-02-26T17:49:38.593Z","title":"Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface","severity":"HIGH","score":8.4,"vendor":"Progress Software Corporation","product":"OpenEdge","kev":false,"epss":0.00958,"kevAdded":null,"exploit":false},{"id":"CVE-2025-6505","published":"2025-07-29T12:56:57.219Z","updated":"2025-07-29T13:25:19.719Z","title":"Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This…","severity":"HIGH","score":8.1,"vendor":"Progress Software","product":"Hybrid Data Pipeline","kev":false,"epss":0.0039,"kevAdded":null,"exploit":false},{"id":"CVE-2025-6504","published":"2025-07-29T12:56:28.054Z","updated":"2025-07-29T13:27:02.851Z","title":"Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"Hybrid Data Pipeline","kev":false,"epss":0.00204,"kevAdded":null,"exploit":false},{"id":"CVE-2025-6725","published":"2025-07-02T14:39:15.442Z","updated":"2025-07-02T14:54:14.971Z","title":"Cross-Site Scripting (XSS) in PdfViewer","severity":"MEDIUM","score":5.4,"vendor":"Progress Software","product":"Kendo UI for jQuery","kev":false,"epss":0.00272,"kevAdded":null,"exploit":false},{"id":"CVE-2025-3600","published":"2025-05-14T13:21:40.770Z","updated":"2025-08-27T14:54:22.319Z","title":"Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"Telerik UI for ASP.NET AJAX","kev":false,"epss":0.26268,"kevAdded":null,"exploit":false},{"id":"CVE-2025-2572","published":"2025-04-14T16:06:45.424Z","updated":"2025-04-14T18:07:07.373Z","title":"WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability","severity":"MEDIUM","score":5.6,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00265,"kevAdded":null,"exploit":false},{"id":"CVE-2025-1968","published":"2025-04-09T13:33:31.450Z","updated":"2026-02-26T18:28:29.081Z","title":"Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session…","severity":"HIGH","score":7.7,"vendor":"Progress Software Corporation","product":"Sitefinity","kev":false,"epss":0.0033,"kevAdded":null,"exploit":false},{"id":"CVE-2025-1758","published":"2025-03-19T15:28:09.883Z","updated":"2025-03-19T17:32:53.423Z","title":"Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions…","severity":"MEDIUM","score":4.3,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.04938,"kevAdded":null,"exploit":false},{"id":"CVE-2025-2324","published":"2025-03-19T15:23:03.486Z","updated":"2025-03-19T20:17:04.235Z","title":"A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder","severity":"MEDIUM","score":5.9,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00267,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6097","published":"2025-02-12T17:37:10.917Z","updated":"2025-02-12T18:54:37.572Z","title":"Absolute Path Traversal Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Progress Software Corporation","product":"Progress® Telerik® Reporting","kev":false,"epss":0.00514,"kevAdded":null,"exploit":false},{"id":"CVE-2024-11629","published":"2025-02-12T16:21:52.058Z","updated":"2025-02-12T19:05:31.058Z","title":"Telerik Document Processing RTF Export of Arbitrary File Path","severity":"HIGH","score":7.1,"vendor":"Progress Software","product":"Progress® Telerik® Document Processing Libraries","kev":false,"epss":0.00384,"kevAdded":null,"exploit":false},{"id":"CVE-2024-11628","published":"2025-02-12T16:17:38.869Z","updated":"2025-02-12T19:06:31.802Z","title":"Prototype Pollution in Progress® Telerik® Kendo UI for Vue","severity":"MEDIUM","score":4.1,"vendor":"Progress Software","product":"Progress® Telerik® Kendo UI for Vue","kev":false,"epss":0.0069,"kevAdded":null,"exploit":false},{"id":"CVE-2024-11343","published":"2025-02-12T15:46:49.360Z","updated":"2025-02-12T19:09:39.955Z","title":"Telerik Document Processing Path Traversal","severity":"HIGH","score":8.3,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.00671,"kevAdded":null,"exploit":false},{"id":"CVE-2024-12629","published":"2025-02-12T15:37:51.840Z","updated":"2025-02-12T15:55:43.633Z","title":"Prototype Pollution in Progress® Telerik® KendoReact","severity":"MEDIUM","score":4.1,"vendor":"Progress Software","product":"Telerik KendoReact","kev":false,"epss":0.0069,"kevAdded":null,"exploit":false},{"id":"CVE-2025-0332","published":"2025-02-12T15:15:31.166Z","updated":"2025-02-12T15:31:36.602Z","title":"Progress UI for WinForms decompression path traversal vulnerability","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Progress® Telerik® UI for WinForms","kev":false,"epss":0.00405,"kevAdded":null,"exploit":false},{"id":"CVE-2025-0556","published":"2025-02-12T15:11:03.067Z","updated":"2025-02-12T15:33:35.788Z","title":"Telerik Report Server Clear Text Transmission of Agent Commands","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"Telerik Report Server","kev":false,"epss":0.00309,"kevAdded":null,"exploit":false},{"id":"CVE-2024-12251","published":"2025-02-12T15:09:46.306Z","updated":"2026-05-08T20:18:38.291Z","title":"Improper neutralization special element in hyperlinks","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik UI for WinUI","kev":false,"epss":0.00521,"kevAdded":null,"exploit":false},{"id":"CVE-2024-56135","published":"2025-02-05T18:02:29.175Z","updated":"2025-02-12T19:41:05.958Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00603,"kevAdded":null,"exploit":false},{"id":"CVE-2024-56134","published":"2025-02-05T18:02:03.882Z","updated":"2025-02-05T18:34:49.816Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00603,"kevAdded":null,"exploit":false},{"id":"CVE-2024-56133","published":"2025-02-05T18:01:31.031Z","updated":"2025-02-05T18:35:44.282Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00603,"kevAdded":null,"exploit":false},{"id":"CVE-2024-56132","published":"2025-02-05T18:01:02.522Z","updated":"2025-02-05T18:38:55.623Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.06286,"kevAdded":null,"exploit":false},{"id":"CVE-2024-56131","published":"2025-02-05T18:00:34.542Z","updated":"2025-02-05T18:39:38.338Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.06119,"kevAdded":null,"exploit":false},{"id":"CVE-2024-11627","published":"2025-01-07T07:49:29.209Z","updated":"2025-01-07T15:36:18.738Z","title":": Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142,…","severity":"MEDIUM","score":6.8,"vendor":"Progress","product":"Sitefinity","kev":false,"epss":0.00329,"kevAdded":null,"exploit":false},{"id":"CVE-2024-11626","published":"2025-01-07T07:49:01.805Z","updated":"2025-01-07T15:37:28.107Z","title":"Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress…","severity":"HIGH","score":8.4,"vendor":"Progress Software Corporation","product":"Sitefinity","kev":false,"epss":0.00362,"kevAdded":null,"exploit":false},{"id":"CVE-2024-11625","published":"2025-01-07T07:48:32.620Z","updated":"2025-01-07T15:38:00.465Z","title":"Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through…","severity":"HIGH","score":7.7,"vendor":"Progress Software Corporation","product":"Sitefinity","kev":false,"epss":0.003,"kevAdded":null,"exploit":false},{"id":"CVE-2024-12105","published":"2024-12-31T10:32:08.238Z","updated":"2025-01-08T13:07:04.839Z","title":"WhatsUp Gold - SnmpExtendedActiveMonitor path traversal","severity":"MEDIUM","score":6.5,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.4168,"kevAdded":null,"exploit":false},{"id":"CVE-2024-12106","published":"2024-12-31T10:32:02.035Z","updated":"2025-01-04T04:55:30.898Z","title":"WhatsUp Gold -  LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication","severity":"CRITICAL","score":9.4,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.0948,"kevAdded":null,"exploit":false},{"id":"CVE-2024-12108","published":"2024-12-31T10:31:56.107Z","updated":"2026-11-03T23:51:56.886Z","title":"WhatsUp Gold - Public API signing key rotation issue","severity":"CRITICAL","score":9.6,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.07677,"kevAdded":null,"exploit":false},{"id":"CVE-2024-10095","published":"2024-12-16T16:59:25.572Z","updated":"2024-12-16T17:26:03.808Z","title":"Progress UI for WPF format provider unsafe deserialization vulnerability","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"Telerik UI for WPF","kev":false,"epss":0.0075,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8785","published":"2024-12-02T14:49:36.748Z","updated":"2024-12-02T15:30:19.766Z","title":"WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.0966,"kevAdded":null,"exploit":false},{"id":"CVE-2024-46909","published":"2024-12-02T14:46:49.513Z","updated":"2024-12-02T15:30:19.651Z","title":"WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.48945,"kevAdded":null,"exploit":false},{"id":"CVE-2024-46905","published":"2024-12-02T14:45:13.504Z","updated":"2024-12-02T15:30:19.092Z","title":"WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.02241,"kevAdded":null,"exploit":false},{"id":"CVE-2024-46906","published":"2024-12-02T14:44:08.220Z","updated":"2024-12-02T15:30:19.268Z","title":"WhatsUp Gold GetSqlWhereClause  SQL Injection Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.40372,"kevAdded":null,"exploit":false},{"id":"CVE-2024-46907","published":"2024-12-02T14:42:08.418Z","updated":"2024-12-02T15:30:19.393Z","title":"WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.02241,"kevAdded":null,"exploit":false},{"id":"CVE-2024-46908","published":"2024-12-02T14:40:08.735Z","updated":"2024-12-02T15:30:19.516Z","title":"WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.02241,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7295","published":"2024-11-13T15:22:28.781Z","updated":"2024-11-13T19:13:33.110Z","title":"Hard-coded credentials used for temporary and cache data encryption","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"Telerik Report Server","kev":false,"epss":0.00106,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8049","published":"2024-11-13T15:20:32.209Z","updated":"2024-11-13T18:28:20.575Z","title":"Telerik Document Processing Improper Handling of Memory Resources","severity":"MEDIUM","score":6.5,"vendor":"Progress Software","product":"Telerik Document Processing Libraries","kev":false,"epss":0.0043,"kevAdded":null,"exploit":false},{"id":"CVE-2024-10012","published":"2024-11-13T15:19:06.329Z","updated":"2024-11-13T19:34:56.312Z","title":"Progress UI for WPF format provider unsafe deserialization vulnerability","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik UI for WPF","kev":false,"epss":0.00228,"kevAdded":null,"exploit":false},{"id":"CVE-2024-10013","published":"2024-11-13T15:17:07.237Z","updated":"2024-11-13T19:43:38.067Z","title":"Progress UI for WinForms format provider unsafe deserialization vulnerability","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik UI for WinForms","kev":false,"epss":0.00222,"kevAdded":null,"exploit":false},{"id":"CVE-2024-9999","published":"2024-11-12T16:33:00.600Z","updated":"2024-11-12T17:19:06.940Z","title":"Multi-Factor Authentication Bypass in Progress WS_FTP Server","severity":"MEDIUM","score":6.5,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00415,"kevAdded":null,"exploit":false},{"id":"CVE-2024-9825","published":"2024-10-28T18:42:39.786Z","updated":"2024-10-29T13:33:52.268Z","title":"The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token","severity":"MEDIUM","score":5.4,"vendor":"Progress Software Corporation","product":"Chef Habitat Builder","kev":false,"epss":0.00279,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7763","published":"2024-10-24T20:11:50.614Z","updated":"2024-10-29T03:55:09.900Z","title":"WhatsUp Gold getReport Missing Authentication Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00613,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8755","published":"2024-10-11T14:19:45.909Z","updated":"2024-11-15T20:05:53.028Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.01172,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8015","published":"2024-10-09T14:49:19.603Z","updated":"2024-10-09T16:06:49.209Z","title":"Telerik Report Server Insecure Type Resolution","severity":"CRITICAL","score":9.1,"vendor":"Progress Software","product":"Telerik Reporting","kev":false,"epss":0.00823,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7292","published":"2024-10-09T14:47:10.831Z","updated":"2024-10-16T15:01:22.209Z","title":"Account Controller allows high count of login attempts","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"Telerik Report Server","kev":false,"epss":0.00334,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7294","published":"2024-10-09T14:45:30.445Z","updated":"2024-10-09T16:17:21.325Z","title":"Uncontrolled resource consumption of anonymous endpoints","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"Telerik Report Server","kev":false,"epss":0.00341,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7293","published":"2024-10-09T14:43:28.711Z","updated":"2024-10-09T16:18:01.674Z","title":"Password policy for new users is not strong enough","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"Telerik Report Server","kev":false,"epss":0.00334,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7840","published":"2024-10-09T14:41:40.048Z","updated":"2025-11-03T19:34:43.663Z","title":"Improper neutralization special element in hyperlinks","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik Reporting","kev":false,"epss":0.00664,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8048","published":"2024-10-09T14:18:56.968Z","updated":"2025-11-03T19:34:46.500Z","title":"Telerik Reporting Insecure Expression Evaluation","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik Reporting","kev":false,"epss":0.00222,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8014","published":"2024-10-09T14:16:33.764Z","updated":"2025-11-03T19:34:45.119Z","title":"Telerik Reporting EntityDataSource Insecure Type Resolution","severity":"HIGH","score":8.8,"vendor":"Progress Software","product":"Telerik Reporting","kev":false,"epss":0.00624,"kevAdded":null,"exploit":false},{"id":"CVE-2024-8316","published":"2024-09-25T13:59:20.369Z","updated":"2024-09-25T14:16:14.295Z","title":"Progress UI for WPF format provider unsafe deserialization vulnerability","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik UI for WPF","kev":false,"epss":0.00246,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7576","published":"2024-09-25T13:57:35.699Z","updated":"2024-09-25T14:17:24.219Z","title":"Progress UI for WPF format provider unsafe deserialization vulnerability","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik UI for WPF","kev":false,"epss":0.00463,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7575","published":"2024-09-25T13:55:59.435Z","updated":"2024-09-25T14:19:30.019Z","title":"Improper neutralization special element in hyperlinks","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik UI for WPF","kev":false,"epss":0.00703,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7679","published":"2024-09-25T13:53:01.102Z","updated":"2024-09-25T14:22:18.409Z","title":"Improper neutralization special element in hyperlinks","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik UI for WinForms","kev":false,"epss":0.00744,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6658","published":"2024-09-12T14:38:48.129Z","updated":"2024-09-23T19:19:19.461Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00553,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7591","published":"2024-09-05T17:16:30.342Z","updated":"2025-02-18T15:36:20.769Z","title":"Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection","severity":"CRITICAL","score":10,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.39181,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7346","published":"2024-09-03T14:51:03.551Z","updated":"2024-09-03T15:06:04.578Z","title":"Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation","severity":"HIGH","score":7.2,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7345","published":"2024-09-03T14:50:15.520Z","updated":"2024-09-03T15:08:13.876Z","title":"Direct local client connections to MS Agents can bypass authentication","severity":"HIGH","score":8.3,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.0059,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7654","published":"2024-09-03T14:48:00.539Z","updated":"2024-09-03T15:09:51.475Z","title":"Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service","severity":"HIGH","score":8.3,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6672","published":"2024-08-29T22:07:13.727Z","updated":"2024-08-30T13:45:45.129Z","title":"WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00714,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6671","published":"2024-08-29T22:06:19.291Z","updated":"2026-11-04T00:10:34.140Z","title":"WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.18988,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6670","published":"2024-08-29T22:04:41.139Z","updated":"2025-10-21T22:55:46.285Z","title":"WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":true,"epss":0.92907,"kevAdded":"2024-09-16","exploit":true},{"id":"CVE-2024-7745","published":"2024-08-28T16:31:03.604Z","updated":"2024-08-28T17:43:13.099Z","title":"Multi-Factor Authentication Bypass in Progress WS_FTP Server","severity":"MEDIUM","score":6.5,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00365,"kevAdded":null,"exploit":false},{"id":"CVE-2024-7744","published":"2024-08-28T16:30:14.787Z","updated":"2024-08-28T17:50:10.933Z","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP Server","severity":"MEDIUM","score":6.5,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00688,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6576","published":"2024-07-29T13:46:32.409Z","updated":"2024-08-01T21:41:03.876Z","title":"MOVEit Transfer Privilege Escalation Vulnerability","severity":"HIGH","score":7.3,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00618,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6096","published":"2024-07-24T14:00:19.107Z","updated":"2025-04-25T23:02:56.247Z","title":"Unsafe Deserialization Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"Telerik Reporting","kev":false,"epss":0.00868,"kevAdded":null,"exploit":false},{"id":"CVE-2024-6327","published":"2024-07-24T13:57:07.165Z","updated":"2024-08-01T21:33:05.307Z","title":"Progress Telerik Report Server Deserialization","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"Telerik Report Server","kev":false,"epss":0.01997,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4882","published":"2024-07-08T17:29:03.986Z","updated":"2024-08-01T20:55:10.225Z","title":"URL Redirection to Arbitrary Site Exists in Sitefinity","severity":"MEDIUM","score":5.3,"vendor":"Progress Software Corporation","product":"Sitefinity","kev":false,"epss":0.00384,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5019","published":"2024-06-25T20:29:00.522Z","updated":"2024-08-01T20:55:10.378Z","title":"WhatsUp Gold LoadCSSUsingBasePath Directory Traversal Information Disclosure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00771,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5018","published":"2024-06-25T20:27:11.395Z","updated":"2024-08-01T20:55:10.444Z","title":"WhatsUp Gold LoadUsingBasePath Directory Traversal Information Disclosure Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00771,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5017","published":"2024-06-25T20:25:37.761Z","updated":"2025-02-13T17:53:46.772Z","title":"WhatsUp Gold AppProfileImport path traversal vulnerability","severity":"MEDIUM","score":6.5,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.01636,"kevAdded":null,"exploit":true},{"id":"CVE-2024-5016","published":"2024-06-25T20:23:46.895Z","updated":"2024-08-01T20:55:10.382Z","title":"WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability","severity":"HIGH","score":7.2,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.22367,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5015","published":"2024-06-25T20:15:07.575Z","updated":"2024-08-01T20:55:10.387Z","title":"WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00525,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5014","published":"2024-06-25T20:13:21.304Z","updated":"2024-08-01T20:55:10.440Z","title":"WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00477,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5013","published":"2024-06-25T20:11:58.100Z","updated":"2024-08-01T20:55:10.406Z","title":"WhatsUp Gold InstallController Denial-of-Service Vulnerability","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00847,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5012","published":"2024-06-25T20:10:33.358Z","updated":"2024-08-01T20:55:10.401Z","title":"WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure Vulnerability","severity":"HIGH","score":8.6,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00445,"kevAdded":null,"exploit":false},{"id":"CVE-2024-5011","published":"2024-06-25T20:01:47.996Z","updated":"2025-02-13T17:53:46.175Z","title":"WhatsUp Gold TestController Chart denial of service vulnerability","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.47092,"kevAdded":null,"exploit":true},{"id":"CVE-2024-5010","published":"2024-06-25T20:00:07.728Z","updated":"2025-02-13T17:53:45.609Z","title":"WhatsUp Gold TestController multiple information disclosure vulnerabilities","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.69952,"kevAdded":null,"exploit":true},{"id":"CVE-2024-5009","published":"2024-06-25T19:58:48.237Z","updated":"2024-08-01T20:55:10.390Z","title":"WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability","severity":"HIGH","score":8.4,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.1742,"kevAdded":null,"exploit":true},{"id":"CVE-2024-5008","published":"2024-06-25T19:57:16.744Z","updated":"2024-08-01T20:55:10.375Z","title":"WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.1733,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4885","published":"2024-06-25T19:48:15.268Z","updated":"2025-10-21T22:56:21.609Z","title":"WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":true,"epss":0.99288,"kevAdded":"2025-03-03","exploit":true},{"id":"CVE-2024-4884","published":"2024-06-25T19:46:22.692Z","updated":"2024-08-01T20:55:10.180Z","title":"WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.24306,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4883","published":"2024-06-25T19:44:42.139Z","updated":"2024-08-01T20:55:10.295Z","title":"WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.64535,"kevAdded":null,"exploit":true},{"id":"CVE-2024-5806","published":"2024-06-25T15:04:37.342Z","updated":"2024-08-01T21:25:02.659Z","title":"MOVEit Transfer Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.81474,"kevAdded":null,"exploit":true},{"id":"CVE-2024-5805","published":"2024-06-25T15:03:03.608Z","updated":"2026-11-04T00:09:50.332Z","title":"MOVEit Gateway Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Progress","product":"MOVEit Gateway","kev":false,"epss":0.06762,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4358","published":"2024-05-29T14:51:21.612Z","updated":"2025-10-21T23:05:17.218Z","title":"Registration Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Progress Software Corporation","product":"Telerik Report Server","kev":true,"epss":0.97482,"kevAdded":"2024-06-13","exploit":true},{"id":"CVE-2024-4563","published":"2024-05-22T17:01:00.943Z","updated":"2024-08-01T20:47:41.067Z","title":"The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length","severity":"MEDIUM","score":6.1,"vendor":"Progress Software Corporation","product":"MOVEit Automation","kev":false,"epss":0.00235,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4837","published":"2024-05-15T17:04:05.705Z","updated":"2024-08-01T20:55:09.990Z","title":"Trust Boundary Violation Vulnerability","severity":"MEDIUM","score":5.3,"vendor":"Progress Software","product":"Telerik Report Server","kev":false,"epss":0.00431,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4357","published":"2024-05-15T16:58:31.306Z","updated":"2024-08-01T20:40:46.481Z","title":"XML External Entity Processing Information Disclosure","severity":"MEDIUM","score":6.5,"vendor":"Progress Software","product":"Telerik Report Server","kev":false,"epss":0.007,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4200","published":"2024-05-15T16:56:25.177Z","updated":"2024-08-01T20:33:53.025Z","title":"Progress Telerik Reporting Local Deserialization Vulnerability","severity":"HIGH","score":7.7,"vendor":"Progress Software Corporation","product":"Telerik Reporting","kev":false,"epss":0.00295,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4202","published":"2024-05-15T16:53:30.262Z","updated":"2024-08-01T20:33:52.951Z","title":"Progress Telerik Reporting Local Instantiation Vulnerability","severity":"HIGH","score":7.7,"vendor":"Progress Software Corporation","product":"Telerik Reporting","kev":false,"epss":0.00273,"kevAdded":null,"exploit":false},{"id":"CVE-2024-3892","published":"2024-05-15T16:43:36.426Z","updated":"2024-08-01T20:26:57.172Z","title":"Local code execution vulnerability in Telerik UI for WinForms","severity":"HIGH","score":7.2,"vendor":"Progress Software Corporation","product":"Telerik UI for WinForms","kev":false,"epss":0.00217,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4562","published":"2024-05-14T20:36:46.905Z","updated":"2024-08-01T20:47:41.116Z","title":"WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettings","severity":"MEDIUM","score":5.4,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00378,"kevAdded":null,"exploit":false},{"id":"CVE-2024-4561","published":"2024-05-14T20:35:17.382Z","updated":"2024-08-01T20:47:41.190Z","title":"WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController","severity":"MEDIUM","score":4.2,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00426,"kevAdded":null,"exploit":false},{"id":"CVE-2024-3544","published":"2024-05-02T14:08:06.683Z","updated":"2024-08-01T20:12:07.654Z","title":"LoadMaster Hardcoded SSH Key","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"LoadMaster","kev":false,"epss":0.00379,"kevAdded":null,"exploit":false},{"id":"CVE-2024-3543","published":"2024-05-02T14:05:26.748Z","updated":"2024-08-08T14:59:24.596Z","title":"LoadMaster Reversible Password Encryption Algorithm","severity":"MEDIUM","score":6.4,"vendor":"Progress Software Corporation","product":"LoadMaster","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2024-2389","published":"2024-04-02T12:22:45.131Z","updated":"2025-12-16T18:13:17.105Z","title":"Flowmon Unauthenticated Command Injection Vulnerability","severity":"CRITICAL","score":10,"vendor":"Progress Software","product":"Flowmon","kev":false,"epss":0.93037,"kevAdded":null,"exploit":true},{"id":"CVE-2024-2449","published":"2024-03-22T13:35:39.103Z","updated":"2024-08-12T19:23:36.632Z","title":"LoadMaster Cross-Site Request Forgery (CSRF)","severity":"HIGH","score":7.5,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.1288,"kevAdded":null,"exploit":false},{"id":"CVE-2024-2448","published":"2024-03-22T13:32:43.657Z","updated":"2024-11-15T20:05:31.723Z","title":"LoadMaster Command Injection Vulnerability","severity":"HIGH","score":8.4,"vendor":"Progress Software","product":"LoadMaster","kev":false,"epss":0.55422,"kevAdded":null,"exploit":false},{"id":"CVE-2024-2291","published":"2024-03-20T14:46:59.040Z","updated":"2024-08-01T19:11:53.265Z","title":"MOVEit Transfer Logging Bypass Vulnerability","severity":"MEDIUM","score":4.3,"vendor":"Progress Software","product":"MOVEit Transfer","kev":false,"epss":0.00385,"kevAdded":null,"exploit":false},{"id":"CVE-2024-1856","published":"2024-03-20T13:13:51.409Z","updated":"2025-12-16T18:13:24.340Z","title":"Progress Telerik Reporting Remote Deserialization Vulnerability","severity":"HIGH","score":8.5,"vendor":"Progress Software Corporation","product":"Telerik Reporting","kev":false,"epss":0.01129,"kevAdded":null,"exploit":false},{"id":"CVE-2024-1801","published":"2024-03-20T13:12:34.826Z","updated":"2025-12-16T18:13:24.178Z","title":"Progress Telerik Reporting Local Deserialization Vulnerability","severity":"HIGH","score":7.7,"vendor":"Progress Software Corporation","product":"Telerik Reporting","kev":false,"epss":0.00422,"kevAdded":null,"exploit":false},{"id":"CVE-2024-1800","published":"2024-03-20T13:11:41.461Z","updated":"2024-08-01T18:48:22.048Z","title":"Progress Telerik Report Server Deserialization","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"Telerik Report Server","kev":false,"epss":0.34247,"kevAdded":null,"exploit":true},{"id":"CVE-2024-1636","published":"2024-02-28T12:05:23.082Z","updated":"2024-08-01T19:14:11.892Z","title":"Potential Cross-Site Scripting (XSS) in the page editing area","severity":"HIGH","score":8,"vendor":"Progress Software Corporation","product":"Sitefinity","kev":false,"epss":0.00399,"kevAdded":null,"exploit":false},{"id":"CVE-2024-1632","published":"2024-02-28T12:04:45.869Z","updated":"2024-08-02T19:28:52.380Z","title":"Incorrect access control in the Sitefinity backend","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"Sitefinity","kev":false,"epss":0.005,"kevAdded":null,"exploit":false},{"id":"CVE-2024-1403","published":"2024-02-27T15:39:54.850Z","updated":"2024-08-12T19:27:43.016Z","title":"Authentication Bypass in OpenEdge Authentication Gateway and AdminServer","severity":"CRITICAL","score":10,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.03272,"kevAdded":null,"exploit":true},{"id":"CVE-2024-1212","published":"2024-02-21T17:39:12.599Z","updated":"2025-10-21T23:05:23.864Z","title":"LoadMaster Pre-Authenticated OS Command Injection","severity":"CRITICAL","score":10,"vendor":"Progress Software","product":"LoadMaster","kev":true,"epss":0.95388,"kevAdded":"2024-11-18","exploit":true},{"id":"CVE-2024-1474","published":"2024-02-21T15:33:20.265Z","updated":"2024-08-01T18:40:21.196Z","title":"WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface","severity":"HIGH","score":7.5,"vendor":"Progress Software Coproration","product":"WS_FTP Server","kev":false,"epss":0.0045,"kevAdded":null,"exploit":false},{"id":"CVE-2024-0833","published":"2024-01-31T15:15:14.656Z","updated":"2024-10-17T17:51:31.449Z","title":"Privilege Elevation via Telerik Test Studio","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik Test Studio","kev":false,"epss":0.00158,"kevAdded":null,"exploit":false},{"id":"CVE-2024-0832","published":"2024-01-31T15:14:44.556Z","updated":"2024-08-23T18:18:34.073Z","title":"Privilege Elevation via Telerik Reporting Installer","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik Reporting","kev":false,"epss":0.00193,"kevAdded":null,"exploit":false},{"id":"CVE-2024-0219","published":"2024-01-31T15:11:21.337Z","updated":"2025-05-29T15:03:44.426Z","title":"Privilege Elevation via Telerik JustDecompile Installer","severity":"HIGH","score":7.8,"vendor":"Progress Software","product":"Telerik JustDecompile","kev":false,"epss":0.00189,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40052","published":"2024-01-18T15:11:51.468Z","updated":"2024-08-29T19:52:53.852Z","title":"Progress Application Server (PAS) for OpenEdge Denial of Service","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"OpenEdge","kev":false,"epss":0.0057,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40051","published":"2024-01-18T15:11:04.080Z","updated":"2025-06-02T15:03:50.714Z","title":"Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal","severity":"CRITICAL","score":9.1,"vendor":"Progress Software Corporation","product":"OpenEdge","kev":false,"epss":0.00557,"kevAdded":null,"exploit":false},{"id":"CVE-2024-0396","published":"2024-01-17T15:56:41.390Z","updated":"2024-11-13T19:52:11.923Z","title":"Missing Server-Side Input Validation in HTTP Parameter","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"MOVEit Transfer","kev":false,"epss":0.00539,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6784","published":"2023-12-20T14:00:55.962Z","updated":"2024-11-27T20:02:36.832Z","title":"Potential Use of the Sitefinity System for Distribution of Phishing Emails","severity":"MEDIUM","score":4.7,"vendor":"Progress Software Corporation","product":"Sitefinity","kev":false,"epss":0.00379,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6368","published":"2023-12-14T16:06:29.101Z","updated":"2024-10-16T14:36:49.428Z","title":"WhatsUp Gold Unauthenticated Access to an API Endpoint","severity":"MEDIUM","score":5.9,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00554,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6595","published":"2023-12-14T16:06:11.767Z","updated":"2024-10-16T14:37:37.331Z","title":"WhatsUp Gold Unauthenticated Access to an API Endpoint","severity":"HIGH","score":7.5,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.008,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6367","published":"2023-12-14T16:05:50.619Z","updated":"2024-08-02T08:28:21.784Z","title":"WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles","severity":"HIGH","score":7.6,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00513,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6366","published":"2023-12-14T16:05:31.492Z","updated":"2025-05-21T14:34:08.582Z","title":"WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center","severity":"HIGH","score":7.6,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00513,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6365","published":"2023-12-14T16:05:08.330Z","updated":"2024-08-02T08:28:21.864Z","title":"WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups","severity":"HIGH","score":7.6,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00513,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6364","published":"2023-12-14T16:04:40.029Z","updated":"2024-08-02T08:28:21.770Z","title":"WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard","severity":"HIGH","score":7.6,"vendor":"Progress Software Corporation","product":"WhatsUp Gold","kev":false,"epss":0.00513,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6218","published":"2023-11-29T16:14:17.324Z","updated":"2024-08-02T08:21:17.955Z","title":"MOVEit Transfer Group Admin Privilege Escalation","severity":"HIGH","score":7.2,"vendor":"Progress Software Corporation","product":"MOVEit Transfer","kev":false,"epss":0.00696,"kevAdded":null,"exploit":false},{"id":"CVE-2023-6217","published":"2023-11-29T16:14:02.264Z","updated":"2024-08-02T08:21:17.933Z","title":"MOVEit Transfer XSS via MOVEit Gateway","severity":"HIGH","score":7.1,"vendor":"Progress Software Corporation","product":"MOVEit Transfer","kev":false,"epss":0.00511,"kevAdded":null,"exploit":false},{"id":"CVE-2023-42659","published":"2023-11-07T15:13:40.001Z","updated":"2024-09-04T15:24:41.092Z","title":"WS_FTP Server Arbitrary File Upload","severity":"CRITICAL","score":9.1,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00896,"kevAdded":null,"exploit":false},{"id":"CVE-2023-42658","published":"2023-10-31T14:08:03.537Z","updated":"2024-09-06T16:00:52.926Z","title":"InSpec Archive Command Vulnerable to Maliciously Crafted Profile","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"Chef InSpec","kev":false,"epss":0.00294,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40050","published":"2023-10-31T14:07:59.881Z","updated":"2024-09-06T15:41:14.418Z","title":"Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"Chef Automate","kev":false,"epss":0.01458,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40049","published":"2023-09-27T14:52:04.667Z","updated":"2024-09-24T14:38:11.547Z","title":"WS_FTP Server Information Disclosure via Directory Listing","severity":"MEDIUM","score":5.3,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00888,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40048","published":"2023-09-27T14:51:35.413Z","updated":"2024-09-23T15:06:42.221Z","title":"WS_FTP Server Cross-Site Request Forgery (CSRF) Vulnerability","severity":"MEDIUM","score":6.8,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00406,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40047","published":"2023-09-27T14:50:55.329Z","updated":"2024-09-24T14:36:57.450Z","title":"WS_FTP Server Stored Cross-Site Scripting Vulnerability","severity":"HIGH","score":8.3,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00414,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40046","published":"2023-09-27T14:50:18.549Z","updated":"2024-09-23T15:07:01.880Z","title":"WS_FTP Server SQL Injection via Administrative Interface","severity":"HIGH","score":8.2,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.01009,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40045","published":"2023-09-27T14:49:45.334Z","updated":"2024-09-24T14:25:59.931Z","title":"WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability","severity":"HIGH","score":8.3,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.00879,"kevAdded":null,"exploit":false},{"id":"CVE-2023-42657","published":"2023-09-27T14:49:03.093Z","updated":"2024-09-24T14:19:21.640Z","title":"WS_FTP Server Directory Traversal","severity":"CRITICAL","score":9.9,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":false,"epss":0.16008,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40044","published":"2023-09-27T14:48:08.190Z","updated":"2025-10-21T23:05:36.645Z","title":"WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability","severity":"CRITICAL","score":10,"vendor":"Progress Software Corporation","product":"WS_FTP Server","kev":true,"epss":0.90355,"kevAdded":"2023-10-05","exploit":true},{"id":"CVE-2023-42656","published":"2023-09-20T16:06:59.527Z","updated":"2024-09-24T18:44:28.016Z","title":"MOVEit Transfer Reflected XSS","severity":"MEDIUM","score":6.1,"vendor":"Progress Software Corporation","product":"MOVEit Transfer","kev":false,"epss":0.00551,"kevAdded":null,"exploit":false},{"id":"CVE-2023-40043","published":"2023-09-20T16:06:00.755Z","updated":"2025-02-27T20:49:18.650Z","title":"MOVEit Transfer System Administrator SQL Injection","severity":"HIGH","score":7.2,"vendor":"Progress Software Corporation","product":"MOVEit Transfer","kev":false,"epss":0.00677,"kevAdded":null,"exploit":false},{"id":"CVE-2023-42660","published":"2023-09-20T16:04:54.432Z","updated":"2025-02-27T20:49:24.513Z","title":"MOVEit Transfer Machine Interface SQL Injection","severity":"HIGH","score":8.8,"vendor":"Progress Software Corporation","product":"MOVEit Transfer","kev":false,"epss":0.00696,"kevAdded":null,"exploit":false}]}