{"items":[{"id":"CVE-2026-89077","published":"2026-10-14T15:16:24.476Z","updated":"2026-10-15T03:56:58.485Z","title":"MOVEit Transfer Identity validation flaw in SFTP authentication","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-89076","published":"2026-10-14T15:15:23.727Z","updated":"2026-10-15T03:57:15.737Z","title":"MOVEit Transfer SQL injection in custom reporting","severity":"HIGH","score":7.2,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00519,"kevAdded":null},{"id":"CVE-2026-89075","published":"2026-10-14T15:14:28.783Z","updated":"2026-10-15T03:57:13.913Z","title":"MOVEit Transfer Local Disclosure of Session Information Vulnerability","severity":"HIGH","score":7.3,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-89074","published":"2026-10-14T15:12:49.542Z","updated":"2026-10-15T03:57:12.922Z","title":"MOVEit Transfer Email MFA Bypass","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00482,"kevAdded":null},{"id":"CVE-2026-89073","published":"2026-10-14T15:11:30.720Z","updated":"2026-10-15T10:31:14.384Z","title":"MOVEit Transfer Access restriction bypass in OAuth authentication","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.004,"kevAdded":null},{"id":"CVE-2026-89072","published":"2026-10-14T15:10:40.581Z","updated":"2026-10-15T10:31:14.513Z","title":"MOVEit Transfer Authorization Flaw in Certificate Management","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-89071","published":"2026-10-14T15:09:45.282Z","updated":"2026-10-15T10:31:14.648Z","title":"MOVEit Transfer LDAP injection in certificate-based authentication","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00521,"kevAdded":null},{"id":"CVE-2026-89070","published":"2026-10-14T15:08:46.009Z","updated":"2026-10-15T10:31:14.784Z","title":"MOVEit Transfer OIDC Authentication Replay Vulnerability","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2026-89069","published":"2026-10-14T15:07:00.959Z","updated":"2026-10-16T15:31:52.383Z","title":"MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages","severity":"HIGH","score":8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00438,"kevAdded":null},{"id":"CVE-2026-89068","published":"2026-10-14T15:06:13.886Z","updated":"2026-10-15T10:31:14.912Z","title":"MOVEit Transfer Authentication bypass in LDAP sign-on","severity":"HIGH","score":8.1,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00536,"kevAdded":null},{"id":"CVE-2026-89067","published":"2026-10-14T15:05:26.675Z","updated":"2026-10-15T10:31:15.047Z","title":"MOVEit Transfer Secure Messaging Authentication Bypass","severity":"HIGH","score":8.8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00529,"kevAdded":null},{"id":"CVE-2026-87093","published":"2026-10-14T15:04:16.517Z","updated":"2026-10-15T10:31:15.286Z","title":"MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation","severity":"HIGH","score":8.8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-93695","published":"2026-10-12T12:52:15.973Z","updated":"2026-10-13T03:55:27.886Z","title":"Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService","severity":"HIGH","score":7.4,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-93694","published":"2026-10-12T12:50:22.621Z","updated":"2026-10-12T14:43:50.913Z","title":"Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller","severity":"MEDIUM","score":4,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00072,"kevAdded":null},{"id":"CVE-2026-93693","published":"2026-10-12T12:48:53.652Z","updated":"2026-10-12T14:43:38.793Z","title":"Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller","severity":"MEDIUM","score":6.5,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-16137","published":"2026-08-17T13:32:45.100Z","updated":"2026-08-18T03:55:24.727Z","title":"Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller","severity":"HIGH","score":7.2,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00743,"kevAdded":null},{"id":"CVE-2026-16138","published":"2026-08-17T13:32:01.432Z","updated":"2026-08-18T03:55:25.792Z","title":"Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service","severity":"HIGH","score":8,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00828,"kevAdded":null},{"id":"CVE-2026-16139","published":"2026-08-17T13:31:14.597Z","updated":"2026-08-18T03:55:26.857Z","title":"Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution","severity":"HIGH","score":7.2,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00935,"kevAdded":null},{"id":"CVE-2026-15968","published":"2026-07-23T20:01:13.408Z","updated":"2026-07-24T13:32:48.089Z","title":"Stored XSS vulnerability in MOVEit Transfer","severity":"HIGH","score":7.1,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-15967","published":"2026-07-23T19:59:33.949Z","updated":"2026-07-25T03:55:22.642Z","title":"MOVEit Transfer refresh-token processing does not enforce updated account restrictions","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-15966","published":"2026-07-23T19:58:01.659Z","updated":"2026-07-25T03:55:21.850Z","title":"Improper CORS handling in MOVEit Transfer","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00373,"kevAdded":null},{"id":"CVE-2026-10697","published":"2026-07-23T19:54:48.304Z","updated":"2026-07-25T03:55:21.025Z","title":"MFA Bypass in MOVEit Transfer","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00596,"kevAdded":null},{"id":"CVE-2026-15724","published":"2026-07-21T16:55:34.486Z","updated":"2026-07-24T03:55:48.821Z","title":"Path traversal in Progress ShareFile Storage Zones Controller (SZC)","severity":"HIGH","score":8.7,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.00524,"kevAdded":null},{"id":"CVE-2026-8801","published":"2026-07-08T19:56:03.468Z","updated":"2026-07-09T13:36:42.815Z","title":"File Extension Restriction Bypass in MOVEit Transfer","severity":"LOW","score":3.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2026-8800","published":"2026-07-08T19:53:30.984Z","updated":"2026-07-09T13:35:24.535Z","title":"Cross-Org External Token Metadata accessible to AuditUser role","severity":"LOW","score":2.7,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-8651","published":"2026-07-08T19:50:43.060Z","updated":"2026-07-09T13:32:24.568Z","title":"IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer","severity":"LOW","score":3.7,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-8650","published":"2026-07-08T19:47:25.636Z","updated":"2026-07-09T13:31:57.971Z","title":"Authenticated Path Traversal allows MOVEit admins to view arbitrary system files","severity":"MEDIUM","score":4.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-8649","published":"2026-07-08T19:41:40.969Z","updated":"2026-07-09T13:29:22.928Z","title":"Institution scope bypass vulnerability in custom reports","severity":"MEDIUM","score":6.4,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00463,"kevAdded":null},{"id":"CVE-2026-11903","published":"2026-07-08T14:19:16.759Z","updated":"2026-07-09T03:55:41.919Z","title":"Stored XSS in MOVEit Transfer Ad Hoc module","severity":"HIGH","score":8,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00408,"kevAdded":null},{"id":"CVE-2026-10699","published":"2026-07-08T14:18:00.255Z","updated":"2026-07-08T15:09:09.431Z","title":"Memory leak in SFTP service can result in a denial of service in MOVEit Transfer","severity":"HIGH","score":7.5,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00494,"kevAdded":null},{"id":"CVE-2026-10698","published":"2026-07-08T14:16:25.696Z","updated":"2026-07-09T03:55:42.859Z","title":"Table scope bypass vulnerability in custom reports","severity":"HIGH","score":7.2,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00644,"kevAdded":null},{"id":"CVE-2026-2701","published":"2026-04-02T13:04:38.554Z","updated":"2026-04-03T03:55:26.174Z","title":"RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)","severity":"CRITICAL","score":9.1,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.54539,"kevAdded":null},{"id":"CVE-2026-2699","published":"2026-04-02T13:04:00.485Z","updated":"2026-04-08T15:25:21.185Z","title":"EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)","severity":"CRITICAL","score":9.8,"vendor":"Progress","product":"ShareFile Storage Zones Controller","kev":false,"epss":0.58386,"kevAdded":null},{"id":"CVE-2025-11235","published":"2026-01-06T22:16:48.036Z","updated":"2026-01-07T16:25:41.732Z","title":"MOVEit Transfer REST API does not require current password in order to initiate the password change process","severity":"LOW","score":3.7,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2025-13147","published":"2025-11-19T20:45:48.418Z","updated":"2025-11-19T20:50:10.151Z","title":"External Service Interaction (DNS)","severity":"MEDIUM","score":5.3,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2025-10703","published":"2025-11-19T15:47:07.908Z","updated":"2026-11-04T00:13:43.168Z","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC…","severity":"HIGH","score":8.6,"vendor":"Progress","product":"DataDirect Connect for JDBC for Amazon Redshift","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-10702","published":"2025-11-19T15:46:26.699Z","updated":"2026-11-04T00:13:28.776Z","title":"Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC…","severity":"HIGH","score":8.6,"vendor":"Progress","product":"DataDirect Connect for JDBC for Amazon Redshift","kev":false,"epss":0.0032,"kevAdded":null},{"id":"CVE-2025-10932","published":"2025-10-29T14:12:33.439Z","updated":"2025-10-29T14:33:14.601Z","title":"AS2 module allows uncontrolled file uploads","severity":"HIGH","score":8.2,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2025-1758","published":"2025-03-19T15:28:09.883Z","updated":"2025-03-19T17:32:53.423Z","title":"Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions…","severity":"MEDIUM","score":4.3,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.04938,"kevAdded":null},{"id":"CVE-2025-2324","published":"2025-03-19T15:23:03.486Z","updated":"2025-03-19T20:17:04.235Z","title":"A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder","severity":"MEDIUM","score":5.9,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00267,"kevAdded":null},{"id":"CVE-2024-56135","published":"2025-02-05T18:02:29.175Z","updated":"2025-02-12T19:41:05.958Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2024-56134","published":"2025-02-05T18:02:03.882Z","updated":"2025-02-05T18:34:49.816Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2024-56133","published":"2025-02-05T18:01:31.031Z","updated":"2025-02-05T18:35:44.282Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00603,"kevAdded":null},{"id":"CVE-2024-56132","published":"2025-02-05T18:01:02.522Z","updated":"2025-02-05T18:38:55.623Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.06286,"kevAdded":null},{"id":"CVE-2024-56131","published":"2025-02-05T18:00:34.542Z","updated":"2025-02-05T18:39:38.338Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.06119,"kevAdded":null},{"id":"CVE-2024-11627","published":"2025-01-07T07:49:29.209Z","updated":"2025-01-07T15:36:18.738Z","title":": Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142,…","severity":"MEDIUM","score":6.8,"vendor":"Progress","product":"Sitefinity","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2024-8755","published":"2024-10-11T14:19:45.909Z","updated":"2024-11-15T20:05:53.028Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.01172,"kevAdded":null},{"id":"CVE-2024-6658","published":"2024-09-12T14:38:48.129Z","updated":"2024-09-23T19:19:19.461Z","title":"Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.","severity":"HIGH","score":8.4,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2024-7591","published":"2024-09-05T17:16:30.342Z","updated":"2025-02-18T15:36:20.769Z","title":"Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection","severity":"CRITICAL","score":10,"vendor":"Progress","product":"LoadMaster","kev":false,"epss":0.39181,"kevAdded":null},{"id":"CVE-2024-7346","published":"2024-09-03T14:51:03.551Z","updated":"2024-09-03T15:06:04.578Z","title":"Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation","severity":"HIGH","score":7.2,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2024-7345","published":"2024-09-03T14:50:15.520Z","updated":"2024-09-03T15:08:13.876Z","title":"Direct local client connections to MS Agents can bypass authentication","severity":"HIGH","score":8.3,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2024-7654","published":"2024-09-03T14:48:00.539Z","updated":"2024-09-03T15:09:51.475Z","title":"Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service","severity":"HIGH","score":8.3,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2024-6576","published":"2024-07-29T13:46:32.409Z","updated":"2024-08-01T21:41:03.876Z","title":"MOVEit Transfer Privilege Escalation Vulnerability","severity":"HIGH","score":7.3,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.00618,"kevAdded":null},{"id":"CVE-2024-5806","published":"2024-06-25T15:04:37.342Z","updated":"2024-08-01T21:25:02.659Z","title":"MOVEit Transfer Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Progress","product":"MOVEit Transfer","kev":false,"epss":0.81474,"kevAdded":null},{"id":"CVE-2024-5805","published":"2024-06-25T15:03:03.608Z","updated":"2026-11-04T00:09:50.332Z","title":"MOVEit Gateway Authentication Bypass Vulnerability","severity":"CRITICAL","score":9.1,"vendor":"Progress","product":"MOVEit Gateway","kev":false,"epss":0.06762,"kevAdded":null},{"id":"CVE-2024-1403","published":"2024-02-27T15:39:54.850Z","updated":"2024-08-12T19:27:43.016Z","title":"Authentication Bypass in OpenEdge Authentication Gateway and AdminServer","severity":"CRITICAL","score":10,"vendor":"Progress","product":"OpenEdge","kev":false,"epss":0.03272,"kevAdded":null}]}