Progress Software vulnerabilities
We track 269 vulnerabilities in Progress Software products across 60+ products. 269 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Progress Software vulnerabilities
- 7.5 High severity
Telerik UI for Blazor: Relative Path Traversal
In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are
- 7.8 High severity
Telerik UI for WPF: URL Redirection to Untrusted Site
In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with
- 7.8 High severity
Telerik UI for WinForms: URL Redirection to Untrusted Site
In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks
- 8.6 High severity
Telerik UI for ASP.NET Core: Uncontrolled Recursion
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does no
- 8.6 High severity
Telerik UI for ASP.NET MVC: Uncaught Exception
In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within th
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may comprom
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a us
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form.
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts
- 7.8 High severity
Telerik UI for .NET MAUI: URL Redirection to Untrusted Site
In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlink handling and the RadPdfViewer link annotation handling allows an unauthenticated attacker to launch arbitrary operatin
- 7.8 High severity
Telerik UI for WPF: Deserialization of Untrusted Data
In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
- 7.8 High severity
Telerik UI for WPF: Improper Control of Generation of Code
In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to execute unauthorized code in the context of the affected application.
- 7.8 High severity
Telerik UI for WinForms: Deserialization of Untrusted Data
In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.
- 7.8 High severity
Telerik UI for WinForms: Improper Control of Generation of Code
In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.
- 7.3 High severity
Telerik Reporting: Deserialization of Untrusted Data
In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process
- 8.6 High severity
Telerik UI for ASP.NET Core: Uncontrolled Resource Consumption
In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consu
- 8.8 High severity
Telerik Report Server: External Control of System or Configuration Setting
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and not
- 8.6 High severity
Telerik UI for ASP.NET MVC: Concurrent Execution using Shared Resource with Improper Synchronization
In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can c
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. Th
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Input During Web Page Generation
In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that exe
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Script-Related HTML Tags in a Web Page
In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including
- 7.1 High severity
Kendo UI for jQuery: Improper Neutralization of Script-Related HTML Tags in a Web Page
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes
- 7.7 High severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
- 7.1 High severity
WS_FTP Server: Cleartext Storage of Sensitive Information
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
- 7.5 High severity
WS_FTP Server: Allocation of Resources Without Limits or Throttling
Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.
- 8.1 High severity
WS_FTP Server: Cleartext Transmission of Sensitive Information
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
- 7.5 High severity
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on…
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On ma
- 7.3 High severity
Progress® Telerik® Fiddler® Everywhere: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
- 7.5 High severity
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared…
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
- 9.9 Critical severity
WS_FTP Server: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
- 8.1 High severity
WS_FTP Server: Improper Access Control
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
- 9.1 Critical severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- 9.0 Critical severity
WS_FTP Server: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
- 9.1 Critical severity
WS_FTP Server: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- 9.1 Critical severity
WS_FTP Server: Missing Authorization
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command exec
- 10.0 Critical severity
WS_FTP Server: Improper Authentication
Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.