Progress Software vulnerabilities
We track 269 vulnerabilities in Progress Software products across 60+ products. 269 are rated high or critical, and 9 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Progress Software vulnerabilities
- 9.8 Critical severity
ShareFile Storage Zones Controller: Improper Access Control
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
- 8.8 High severity
Flowmon ADS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute unintended SQL queries and commands.
- 7.5 High severity
MOVEit Transfer: Unverified Password Change
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
- 8.6 High severity
DataDirect Connect for JDBC for Amazon Redshift: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option imple
- 8.6 High severity
DataDirect Connect for JDBC for Amazon Redshift: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option imple
- 8.2 High severity
MOVEit Transfer: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.
- 8.8 High severity
Flowmon: Improper Neutralization of Input During Web Page Generation
A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated session.
- 7.2 High severity
Flowmon: Improper Neutralization of Special Elements used in an OS Command
In Flowmon versions prior to 12.5.5, a vulnerability has been identified that allows a user with administrator privileges and access to the management interface to execute additional unintended commands within scripts intended for troubleshooting purposes.
- 8.8 High severity
Chef Automate: Improper Neutralization of Special Elements used in an SQL Command
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a wel
- 8.8 High severity
Chef Automate: Improper Neutralization of Special Elements used in an SQL Command
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.
- 8.4 High severity
OpenEdge: Improper Neutralization of Special Elements used in a Command
It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority of the AdminServer process. An RMI interface permitted ma
- 8.1 High severity
Hybrid Data Pipeline: Improper Authentication
Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client imper
- 8.4 High severity
Hybrid Data Pipeline: Insufficient Verification of Data Authenticity
In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelist
- 7.5 High severity
Telerik UI for ASP.NET AJAX: Use of Externally-Controlled Input to Select Classes or Code
In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.
- 7.7 High severity
Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity…
Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before
- 8.8 High severity
MOVEit Transfer: Improper Privilege Management
Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 20
- 8.8 High severity
LoadMaster: Stack-based Buffer Overflow
Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above
- 7.2 High severity
Progress® Telerik® Kendo UI for Vue: Improperly Controlled Modification of Object Prototype Attributes
In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
- 9.8 Critical severity
Progress® Telerik® UI for WinForms: Improper Limitation of a Pathname to a Restricted Directory
In Progress® Telerik® UI for WinForms, versions prior to 2025 Q1 (2025.1.211), using the improper limitation of a target path can lead to decompressing an archive's content into a restricted directory.
- 7.2 High severity
Telerik KendoReact: Improperly Controlled Modification of Object Prototype Attributes
In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
- 8.8 High severity
Telerik Document Processing Libraries: Improper Limitation of a Pathname to a Restricted Directory
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.
- 7.8 High severity
Telerik UI for WinUI: Improper Neutralization of Special Elements used in a Command
In Progress Telerik UI for WinUI versions prior to 2025 Q1 (3.0.0), a command injection attack is possible through improper neutralization of hyperlink elements.
- 8.1 High severity
: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session…
: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
- 9.8 Critical severity
Telerik UI for WPF: Deserialization of Untrusted Data
In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserialization vulnerability.
- 9.8 Critical severity
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could…
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage this vulnerability to execute code in the context of the service account.
- 8.8 High severity
WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.
- 8.8 High severity
WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.
- 8.8 High severity
WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated low-privileged user (at least Report Viewer permissions required) to achieve privilege escalation to the admin account.
- 8.8 High severity
WhatsUp Gold: Improper Neutralization of Special Elements used in an SQL Command
In WhatsUp Gold versions released before 2024.0.1, a SQL Injection vulnerability allows an authenticated lower-privileged user (at least Network Manager permissions required) to achieve privilege escalation to the admin account.
- 7.8 High severity
Telerik UI for WinForms: Deserialization of Untrusted Data
In Progress Telerik UI for WinForms versions prior to 2024 Q4 (2024.4.1113), a code execution attack is possible through an insecure deserialization vulnerability.
- 7.8 High severity
Telerik UI for WPF: Deserialization of Untrusted Data
In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1111), a code execution attack is possible through an insecure deserialization vulnerability.
- 7.5 High severity
WhatsUp Gold: Improper Authentication
In WhatsUp Gold versions released before 2024.0.0, an Authentication Bypass issue exists which allows an attacker to obtain encrypted user credentials.
- 9.8 Critical severity
LoadMaster: Improper Neutralization of Special Elements used in an OS Command
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.49.0 to 7.2.54.12 (inclusive) 7.2.48.12 a
- 7.8 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.
- 7.2 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 8.8 High severity
Telerik Reporting: Use of Externally-Controlled Input to Select Classes or Code
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.
- 7.8 High severity
Telerik Reporting: Improper Neutralization of Special Elements used in a Command
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.
- 8.8 High severity
Telerik Report Server: Weak Password Requirements
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
- 8.8 High severity
Telerik Report Server: Improper Restriction of Excessive Authentication Attempts
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
- 7.8 High severity
Telerik UI for WPF: Deserialization of Untrusted Data
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.