Progress Software
Number 64 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
285
Critical
48
High
158
Known Exploited
6
Exploit available
1
Network, no login needed
40.4%
Of 285 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 163 | 26 | 86 | 50 | 1 | 0 |
| 2025 | 22 | 1 | 15 | 6 | 0 | 0 |
| 2024 | 78 | 17 | 44 | 17 | 0 | 0 |
| 2023 | 22 | 4 | 13 | 5 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| WhatsUp Gold | 42 | 31 |
| MarkLogic Server | 41 | 39 |
| WS_FTP Server | 32 | 19 |
| Telerik UI for ASP.NET AJAX | 19 | 14 |
| LoadMaster | 17 | 16 |
| Kendo UI for jQuery | 15 | 1 |
| Sitefinity | 12 | 10 |
| Telerik Report Server | 12 | 10 |
| Telerik Reporting | 10 | 10 |
| Telerik Document Processing Libraries | 9 | 8 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Cross-Site Scripting | 28 | 17 |
| Command Injection | 23 | 23 |
| Path Traversal | 20 | 14 |
| Authentication Issues | 16 | 12 |
| Privilege Escalation | 16 | 15 |
| Insecure Deserialization | 15 | 15 |
| SQL Injection | 13 | 13 |
| Server-Side Request Forgery | 10 | 7 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 9 | 0 |
| Information Disclosure | 8 | 5 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-8037 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF | Critical | 99.8% | |
| CVE-2024-6670 | WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability | Critical | 92.9% | |
| CVE-2024-4885 | WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability | Critical | 99.3% | |
| CVE-2024-4358 | Registration Authentication Bypass Vulnerability | Critical | 97.5% | |
| CVE-2024-1212 | LoadMaster Pre-Authenticated OS Command Injection | Critical | 95.4% | |
| CVE-2023-40044 | WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability | Critical | 90.4% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-115341 | Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server | High | 0.4% | |
| CVE-2026-115340 | Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server | High | 0.1% | |
| CVE-2026-115339 | Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server | High | 0.4% | |
| CVE-2026-115338 | Insecure XFT Transport in Progress WS_FTP Server | High | 0.2% | |
| CVE-2026-115337 | Folder Permission Bypass in Progress WS_FTP Server | Medium | 0.2% | |
| CVE-2026-115336 | FTP Quota Accounting Bypass in Progress WS_FTP Server | Medium | 0.3% | |
| CVE-2026-106144 | Prototype Pollution in Progress Software Kendo UI for Angular | Medium | 0.2% | |
| CVE-2026-106143 | Cross-Site Scripting in Progress Software Kendo UI for Vue | Medium | 0.1% | |
| CVE-2026-106142 | Cross-Site Scripting in Progress Software KendoReact | Medium | 0.2% | |
| CVE-2026-106141 | Cross-Site Scripting in Progress Software Kendo UI for Angular | Medium | 0.2% |