Skip to content
OpenAdvisories

Vendor

Progress Software

285 known vulnerabilities.

Products

WhatsUp Gold 42 MarkLogic Server 41 WS_FTP Server 32 Telerik UI for ASP.NET AJAX 19 LoadMaster 17 Kendo UI for jQuery 15 Sitefinity 12 Telerik Report Server 12 Telerik Reporting 10 Object Scale Connection Manager 10 MOVEit WAF 10 Telerik Document Processing Libraries 9 MOVEit Automation 7 Flowmon 7 MOVEit Transfer 7 KendoReact 6 ECS Connections Manager 5 Telerik UI for WPF 5 ECS Connection Manager 5 OpenEdge 5 Chef Automate 4 Kendo UI for Angular 4 Progress® Telerik® Fiddler® Classic 4 Flowmon ADS 4 Progress® Telerik® Fiddler® Everywhere 3 Telerik UI for WinForms 3 Kendo UI for Vue 3 Chef Inspec 2 Hybrid Data Pipeline 2 Telerik UI for ASP.NET MVC 1 Telerik UI for ASP.NET Core 1 Telerik UI for Blazor 1 Autonomous REST Connector GenAI Agents 1 Chef Habitat Builder 1 Telerik JustDecompile 1 Telerik KendoReact 1 Progress® Telerik® Reporting 1 Telerik UI for WinUI 1 Telerik Test Studio 1 Fiddler Download & Setup Skill 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-84295 Public exploit

    Improper Authentication in Progress WS_FTP Server

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

    Progress Software WS_FTP Server
  • Critical 9.6
    CVE-2026-8037 Exploited Public exploit EPSS 100%

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

    Progress Software LoadMaster MOVEit WAF Object Scale Connection Manager
    KEV Aug 7, 2026
  • Critical 9.8
    CVE-2024-6670 Exploited · Ransomware Public exploit EPSS 93%

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

    Progress Software WhatsUp Gold
    KEV Sep 16, 2024
  • Critical 9.8
    CVE-2024-4885 Exploited Public exploit EPSS 99%

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

    Progress Software WhatsUp Gold
    KEV Mar 3, 2025
  • Critical 9.8
    CVE-2024-4883 Public exploit EPSS 65%

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.

    Progress Software WhatsUp Gold
  • Critical 9.8
    CVE-2024-4358 Exploited Public exploit EPSS 97%

    Registration Authentication Bypass Vulnerability

    In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

    Progress Software Telerik Report Server
    KEV Jun 13, 2024
  • Critical 10.0
    CVE-2024-2389 Public exploit EPSS 93%

    Flowmon Unauthenticated Command Injection Vulnerability

    In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.  An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary syste…

    Progress Software Flowmon
  • Critical 9.9
    CVE-2024-1800 Public exploit EPSS 34%

    Progress Telerik Report Server Deserialization

    In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.

    Progress Software Telerik Report Server
  • Critical 10.0
    CVE-2024-1212 Exploited Public exploit EPSS 95%

    LoadMaster Pre-Authenticated OS Command Injection

    Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

    Progress Software LoadMaster
    KEV Nov 18, 2024
  • Critical 10.0
    CVE-2023-40044 Exploited · Ransomware Public exploit EPSS 90%

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

    Progress Software WS_FTP Server
    KEV Oct 5, 2023