Progress

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Progress product.

RSS Feeds for Progress security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Progress products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Progress Sorted by Most Security Vulnerabilities since 2018

Progress Whatsup Gold57 vulnerabilities

Progress Moveit Transfer50 vulnerabilities

Progress Ws Ftp Server29 vulnerabilities

Progress Sitefinity15 vulnerabilities

Progress Telerik Reporting14 vulnerabilities

Progress Loadmaster14 vulnerabilities

Progress Openedge11 vulnerabilities

Progress Telerik Report Server9 vulnerabilities

Progress Multi Tenant Loadmaster7 vulnerabilities

Progress Telerik Ui For Winforms4 vulnerabilities

Progress Telerik Ui For Asp Net Ajax3 vulnerabilities

Progress Telerik Document Processing Libraries3 vulnerabilities

Progress Whatsupgold2 vulnerabilities

Progress Flowmon Os2 vulnerabilities

Progress Openedge Innovation2 vulnerabilities

Progress Telerik Test Studio1 vulnerability

Progress Flowmon1 vulnerability

Progress Telerik Justdecompile1 vulnerability

Progress Kendoreact1 vulnerability

Progress Moveit Gateway1 vulnerability

Progress Moveit Automation1 vulnerability

Progress Kendo Ui For Vue1 vulnerability

Known Exploited Progress Vulnerabilities

The following Progress vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Progress LoadMaster Command Injection Vulnerability	Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. CVE-2026-8037 Exploit Probability: 0.8%	August 7, 2026
Progress WhatsUp Gold Path Traversal Vulnerability	Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution. CVE-2024-4885 Exploit Probability: 99.3%	March 3, 2025
Progress Kemp LoadMaster OS Command Injection Vulnerability	Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. CVE-2024-1212 Exploit Probability: 95.4%	November 18, 2024
Progress WhatsUp Gold SQL Injection Vulnerability	Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. CVE-2024-6670 Exploit Probability: 93.0%	September 16, 2024
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability	Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. CVE-2024-4358 Exploit Probability: 97.5%	June 13, 2024
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability	Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system. CVE-2023-40044 Exploit Probability: 90.4%	October 5, 2023
Progress MOVEit Transfer SQL Injection Vulnerability	Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements. CVE-2023-34362 Exploit Probability: 99.9%	June 2, 2023

Of the known exploited vulnerabilities above, 6 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 36 vulnerabilities in Progress with an average score of 7.0 out of ten. Last year, in 2025 Progress had 24 security vulnerabilities published. That is, 12 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.04

Year	Vulnerabilities	Average Score
2026	36	6.99
2025	24	7.03
2024	83	7.87
2023	37	7.08
2022	8	6.70
2021	6	8.68
2020	3	5.40
2019	5	6.53
2018	9	8.13

It may take a day or so for new Progress vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Progress Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-89077	Oct 14, 2026	AuthAlg Fault in MOVEit Transfer < 2025.1.6, < 2026.0.4 Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89076	Oct 14, 2026	Progress MOVEit Transfer SQLi in Custom Reports (2025.1.5, 2026.0.02026.0.3) Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89075	Oct 14, 2026	Insecure Storage of Sensitive Data in MOVEit Transfer <=2025.1.6 & 2026.0.0-2026.0.3 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89074	Oct 14, 2026	Unicode Encoding Flaw in MOVEit Transfer (<2025.1.6, 2026.0.02026.0.3) Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89073	Oct 14, 2026	Insufficient Session Exp. in MOVEit Transfer 2025.1.6, 2026.0.0<2026.0.4 Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89072	Oct 14, 2026	Incorrect Auth in Progress MOVEit Transfer Client Certs (2025.1.5, 2026.0.0-2026.0.3) Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89071	Oct 14, 2026	Progress MOVEit Transfer LDAP Injection (2025.1.6, <2026.0.4) Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89070	Oct 14, 2026	MOVEit Transfer Auth Bypass via Capture-Replay OIDC v<2025.1.6 & 2026.0.0-2026.0.4 Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89069	Oct 14, 2026	Progress MOVEit Transfer XSS in Ad Hoc Module (before 2025.1.6, 2026.0.0<2026.0.4) Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89068	Oct 14, 2026	MOVEit Transfer LDAP Auth Bypass before 2025.1.6 & 2026.0.0-4 Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-89067	Oct 14, 2026	Auth Bypass via Alt Path in Progress MOVEit Transfer <2025.1.6 / <2026.0.4 Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-87093	Oct 14, 2026	Incorrect Permission Assign in MOVEit Transfer (pre-5.1.6, 2026.0.0-2026.0.4) Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.	Moveit Transfer
CVE-2026-93695	Oct 12, 2026	Progress ShareFile Storage Zones Controller 5.12.6 RCE via FileCopyService In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.
CVE-2026-93694	Oct 12, 2026	Progress ShareFile Storage Zones Controller 5.12.6: Unvalidated Callback URL Race In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.
CVE-2026-93693	Oct 12, 2026	Progress ShareFile Controller v5.12.6: SSRF via Unvalidated Destinations In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.
CVE-2026-16137	Aug 17, 2026	Path traversal in Progress ShareFile SZ Controller <5.12.5 In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.
CVE-2026-16138	Aug 17, 2026	Unsafe Deserialization in Progress ShareFile Zones Controller 5.12.5 (RCE) In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
CVE-2026-16139	Aug 17, 2026	Insecure file download in Progress ShareFile <=5.12.5/6.0.2 enables RCE In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.
CVE-2026-65939	Aug 12, 2026	WhatsUp Gold < 26.0.2 LogToFile Action Arbitrary File Extension Injection In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.	Whatsup Gold
CVE-2026-15968	Jul 23, 2026	Progress MOVEit Transfer XSS before 2025.1.5 & 2026.0.02026.0.3 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	Moveit Transfer
CVE-2026-15967	Jul 23, 2026	Insuff Sess Exp in Progress MOVEit Transfer v<2025.1.5 / 2026.0.0<3 Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	Moveit Transfer
CVE-2026-15966	Jul 23, 2026	CrossDomain Policy Misconfig in Progress MOVEit Transfer <2025.1.5/2026.0.0<0.3 Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	Moveit Transfer
CVE-2026-10697	Jul 23, 2026	Improper Auth: MOVEit Transfer (<2025.1.5, 2026.0.0-2026.0.2) Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.	Moveit Transfer
CVE-2026-15724	Jul 21, 2026	Progress ShareFile Storage Zones Controller Path Traversal (<=5.12.5/6.0.2) In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.
CVE-2026-8801	Jul 08, 2026	Path Equiv Vulnerability in MOVEit Transfer (<2025.0.8, 2025.1.0-2025.1.3) Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.	Moveit Transfer
CVE-2026-8800	Jul 08, 2026	Incorrect Auth in Progress MOVEit Transfer Audit User Module before 2025.1.3 Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.	Moveit Transfer
CVE-2026-8651	Jul 08, 2026	Progress MOVEit Transfer HTTPS Auth Bypass (v < 2025.1.3) Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.	Moveit Transfer
CVE-2026-8650	Jul 08, 2026	Relative Path Traversal in MOVEit Transfer (v<=2025.0.6, 2025.1.0-2025.1.2) Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.	Moveit Transfer
CVE-2026-8649	Jul 08, 2026	MOVEit Transfer <=2025.0.6 Custom Reports SQL Injection Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.	Moveit Transfer
CVE-2026-11903	Jul 08, 2026	XSS Vulnerability in Progress MOVEit Transfer Ad Hoc (v < 2025.1.4, < 2026.0.1) Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.	Moveit Transfer
CVE-2026-10699	Jul 08, 2026	MOVEit Transfer <5.0.8, <5.1.4, <6.0.1 Mem Leak in Custom Reports Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.	Moveit Transfer
CVE-2026-10698	Jul 08, 2026	MOVEit Transfer SQLi in Data Query (2025.0.0-2025.0.8,2025.1.0-2025.1.4,2026.0.0-2026.0.1) Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.	Moveit Transfer
CVE-2025-7389	Apr 14, 2026	OpenEdge 12.2.x/12.8.x AdminServer RMI Elevation (setFile/openFile) OS-level A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile() methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.	Openedge
CVE-2026-2701	Apr 02, 2026	ProgressSoftware RCE via Authenticated File Upload Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.
CVE-2026-2699	Apr 02, 2026	Unauthenticated RCE via Config Access in ShareFile SZC Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.
CVE-2025-11235	Jan 06, 2026	Progress MOVEit Transfer Unverified Password Change (REST API) <2023.1.3 Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.	Moveit Transfer
CVE-2025-13147	Nov 19, 2025	Progress MOVEit Transfer SSRF Vulnerability: before 2024.1.8, 2025.0.04.0.3 Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.	Moveit Transfer
CVE-2025-10703	Nov 19, 2025	Code Injection via SpyAttribute log=(file) in Progress DataDirect Connect JDBC Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver and the DataDirect OpenAccess JDBC driver log=(file) construct allows the user to specify an arbitrary file for the JDBC driver to write its log information to. If an application allows an end user to specify a value for the SpyAttributes connection option then an attacker could cause java script to be written to a log file. If the log file was in the correct location with the correct extension, an application server could see that log file as a resource to be served. The attacker could fetch the resource from the server causing the java script to be executed. This issue affects: DataDirect Connect for JDBC for Amazon Redshift: through 6.0.0.001392, fixed in 6.0.0.001541 DataDirect Connect for JDBC for Apache Cassandra: through 6.0.0.000805, fixed in 6.0.0.000833 DataDirect Connect for JDBC for Hive: through 6.0.1.001499, fixed in 6.0.1.001628 DataDirect Connect for JDBC for Apache Impala: through 6.0.0.001155, fixed in 6.0.0.001279 DataDirect Connect for JDBC for Apache SparkSQL: through 6.0.1.001222, fixed in 6.0.1.001344 DataDirect Connect for JDBC Autonomous REST Connector: through 6.0.1.006961, fixed in 6.0.1.007063 DataDirect Connect for JDBC for DB2: through 6.0.0.000717, fixed in 6.0.0.000964 DataDirect Connect for JDBC for Google Analytics 4: through 6.0.0.000454, fixed in 6.0.0.000525 DataDirect Connect for JDBC for Google BigQuery: through 6.0.0.002279, fixed in 6.0.0.002410 DataDirect Connect for JDBC for Greenplum: through 6.0.0.001712, fixed in 6.0.0.001727 DataDirect Connect for JDBC for Informix: through 6.0.0.000690, fixed in 6.0.0.0851 DataDirect Connect for JDBC for Microsoft Dynamics 365: through 6.0.0.003161, fixed in 6.0.0.3198 DataDirect Connect for JDBC for Microsoft SQLServer: through 6.0.0.001936, fixed in 6.0.0.001957 DataDirect Connect for JDBC for Microsoft Sharepoint: through 6.0.0.001559, fixed in 6.0.0.001587 DataDirect Connect for JDBC for MongoDB: through 6.1.0.001654, fixed in 6.1.0.001669 DataDirect Connect for JDBC for MySQL: through 5.1.4.000330, fixed in 5.1.4.000364 DataDirect Connect for JDBC for Oracle Database: through 6.0.0.001747, fixed in 6.0.0.001776 DataDirect Connect for JDBC for Oracle Eloqua: through 6.0.0.001438, fixed in 6.0.0.001458 DataDirect Connect for JDBC for Oracle Sales Cloud: through 6.0.0.001225, fixed in 6.0.0.001316 DataDirect Connect for JDBC for Oracle Service Cloud: through 5.1.4.000298, fixed in 5.1.4.000309 DataDirect Connect for JDBC for PostgreSQL: through 6.0.0.001843, fixed in 6.0.0.001856 DataDirect Connect for JDBC for Progress OpenEdge: through 5.1.4.000187, fixed in 5.1.4.000189 DataDirect Connect for JDBC for Salesforce: through 6.0.0.003020, fixed in 6.0.0.003125 DataDirect Connect for JDBC for SAP HANA: through 6.0.0.000879, product retired DataDirect Connect for JDBC for SAP S/4 HANA: through 6.0.1.001818, fixed in 6.0.1.001858 DataDirect Connect for JDBC for Sybase ASE: through 5.1.4.000161, fixed in 5.1.4.000162 DataDirect Connect for JDBC for Snowflake: through 6.0.1.001821, fixed in 6.0.1.001856 DataDirect Hybrid Data Pipeline Server: through 4.6.2.3309, fixed in 4.6.2.3430 DataDirect Hybrid Data Pipeline JDBC Driver: through 4.6.2.0607, fixed in 4.6.2.1023 DataDirect Hybrid Data Pipeline On Premises Connector: through 4.6.2.1223, fixed in 4.6.2.1339 DataDirect Hybrid Data Pipeline Docker: through 4.6.2.3316, fixed in 4.6.2.3430 DataDirect OpenAccess JDBC Driver: through 8.1.0.0177, fixed in 8.1.0.0183 DataDirect OpenAccess JDBC Driver: through 9.0.0.0019, fixed in 9.0.0.0022	Openedge
CVE-2025-10702	Nov 19, 2025	CVE-2025-10702: SpyAttributes Code Injection in Progress DataDirect JDBC Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver and the DataDirect OpenAccess JDBC driver supports an undocumented syntax construct for the option value that if discovered can be used by an attacker. If an application allows an end user to specify a value for the SpyAttributes connection option then an attacker can use the undocumented syntax to cause the driver to load an arbitrary class on the class path and execute a constructor on that class. This issue affects: DataDirect Connect for JDBC for Amazon Redshift: through 6.0.0.001392, fixed in 6.0.0.001541 DataDirect Connect for JDBC for Apache Cassandra: through 6.0.0.000805, fixed in 6.0.0.000833 DataDirect Connect for JDBC for Hive: through 6.0.1.001499, fixed in 6.0.1.001628 DataDirect Connect for JDBC for Apache Impala: through 6.0.0.001155, fixed in 6.0.0.001279 DataDirect Connect for JDBC for Apache SparkSQL: through 6.0.1.001222, fixed in 6.0.1.001344 DataDirect Connect for JDBC Autonomous REST Connector: through 6.0.1.006961, fixed in 6.0.1.007063 DataDirect Connect for JDBC for DB2: through 6.0.0.000717, fixed in 6.0.0.000964 DataDirect Connect for JDBC for Google Analytics 4: through 6.0.0.000454, fixed in 6.0.0.000525 DataDirect Connect for JDBC for Google BigQuery: through 6.0.0.002279, fixed in 6.0.0.002410 DataDirect Connect for JDBC for Greenplum: through 6.0.0.001712, fixed in 6.0.0.001727 DataDirect Connect for JDBC for Informix: through 6.0.0.000690, fixed in 6.0.0.0851 DataDirect Connect for JDBC for Microsoft Dynamics 365: through 6.0.0.003161, fixed in 6.0.0.3198 DataDirect Connect for JDBC for Microsoft SQLServer: through 6.0.0.001936, fixed in 6.0.0.001957 DataDirect Connect for JDBC for Microsoft Sharepoint: through 6.0.0.001559, fixed in 6.0.0.001587 DataDirect Connect for JDBC for MongoDB: through 6.1.0.001654, fixed in 6.1.0.001669 DataDirect Connect for JDBC for MySQL: through 5.1.4.000330, fixed in 5.1.4.000364 DataDirect Connect for JDBC for Oracle Database: through 6.0.0.001747, fixed in 6.0.0.001776 DataDirect Connect for JDBC for Oracle Eloqua: through 6.0.0.001438, fixed in 6.0.0.001458 DataDirect Connect for JDBC for Oracle Sales Cloud: through 6.0.0.001225, fixed in 6.0.0.001316 DataDirect Connect for JDBC for Oracle Service Cloud: through 5.1.4.000298, fixed in 5.1.4.000309 DataDirect Connect for JDBC for PostgreSQL: through 6.0.0.001843, fixed in 6.0.0.001856 DataDirect Connect for JDBC for Progress OpenEdge: through 5.1.4.000187, fixed in 5.1.4.000189 DataDirect Connect for JDBC for Salesforce: through 6.0.0.003020, fixed in 6.0.0.003125 DataDirect Connect for JDBC for SAP HANA: through 6.0.0.000879, product retired DataDirect Connect for JDBC for SAP S/4 HANA: through 6.0.1.001818, fixed in 6.0.1.001858 DataDirect Connect for JDBC for Sybase ASE: through 5.1.4.000161, fixed in 5.1.4.000162 DataDirect Connect for JDBC for Snowflake: through 6.0.1.001821, fixed in 6.0.1.001856 DataDirect Hybrid Data Pipeline Server: through 4.6.2.3309, fixed in 4.6.2.3430 DataDirect Hybrid Data Pipeline JDBC Driver: through 4.6.2.0607, fixed in 4.6.2.1023 DataDirect Hybrid Data Pipeline On Premises Connector: through 4.6.2.1223, fixed in 4.6.2.1339 DataDirect Hybrid Data Pipeline Docker: through 4.6.2.3316, fixed in 4.6.2.3430 DataDirect OpenAccess JDBC Driver: through 8.1.0.0177, fixed in 8.1.0.0183 DataDirect OpenAccess JDBC Driver: through 9.0.0.0019, fixed in 9.0.0.0022	Openedge
CVE-2025-10932	Oct 29, 2025	Uncontrolled Resource Consumption in MOVEit Transfer AS2 Module (pre2025.0.3) Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module).This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16.	Moveit Transfer
CVE-2025-3600	May 14, 2025	Unsafe Reflection in Telerik UI for AJAX v2011.2.712–2025.1.218 – DoS Crash In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service.	Telerik Ui For Asp Net Ajax
CVE-2025-2572	Apr 14, 2025	WhatsUp Gold <=2024.0.2 Unauth DB Manipulation via WrlsMacAddressGroup In WhatsUp Gold versions released before 2024.0.3, a database manipulation vulnerability allows an unauthenticated attacker to modify the contents of WhatsUp.dbo.WrlsMacAddressGroup.	Whatsup Gold
CVE-2025-1968	Apr 09, 2025	Insufficient Session Expiration in Progress Sitefinity 14–15.2 (before 15.2.8429) Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.	Sitefinity
CVE-2025-1758	Mar 19, 2025	Progress LoadMaster 7.2.40+ Buffer Overflow via Improper Input Validation Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above	Loadmaster Multi Tenant Loadmaster
CVE-2025-2324	Mar 19, 2025	Privilege Escalation in Progress MOVEit Transfer SFTP (Shared Accounts) – before 2024.1.2 Improper Privilege Management vulnerability for users configured as Shared Accounts in Progress MOVEit Transfer (SFTP module) allows Privilege Escalation.This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.12, from 2024.0.0 before 2024.0.8, from 2024.1.0 before 2024.1.2.	Moveit Transfer
CVE-2024-6097	Feb 12, 2025	Telerik Reporting 19.0.25.211 Info Disclosure Absolute Path Vulnerability In Progress® Telerik® Reporting versions prior to 2025 Q1 (19.0.25.211), information disclosure is possible by a local threat actor through an absolute path vulnerability.	Telerik Reporting
CVE-2024-11629	Feb 12, 2025	Telerik Document Processing Lib before 2025.1.205: Arbitrary File Export to RTF In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF.	Telerik Document Processing Libraries
CVE-2024-11628	Feb 12, 2025	Prototype Pollution in Telerik Kendo UI Vue v2.4v6.0.1 Enables Injection In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.	Kendo Ui For Vue
CVE-2024-12629	Feb 12, 2025	KendoReact Prototype Pollution v3.5.0-v9.4.0 Progress Telerik In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.	Kendoreact
CVE-2024-11343	Feb 12, 2025	Telerik DP Libs <2025 Q1: Unzip Causes Arbitrary FS Access In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.	Telerik Document Processing Libraries