Skip to content
OpenAdvisories

Vendor

Progress Software

279 known vulnerabilities.

Products

WhatsUp Gold 42 MarkLogic Server 41 WS_FTP Server 26 Telerik UI for ASP.NET AJAX 19 LoadMaster 17 Kendo UI for jQuery 15 Sitefinity 12 Telerik Report Server 12 Telerik Reporting 10 Object Scale Connection Manager 10 MOVEit WAF 10 Telerik Document Processing Libraries 9 MOVEit Automation 7 Flowmon 7 MOVEit Transfer 7 KendoReact 6 ECS Connections Manager 5 Telerik UI for WPF 5 ECS Connection Manager 5 OpenEdge 5 Chef Automate 4 Kendo UI for Angular 4 Progress® Telerik® Fiddler® Classic 4 Flowmon ADS 4 Progress® Telerik® Fiddler® Everywhere 3 Telerik UI for WinForms 3 Kendo UI for Vue 3 Chef Inspec 2 Hybrid Data Pipeline 2 Telerik UI for ASP.NET MVC 1 Telerik UI for ASP.NET Core 1 Telerik UI for Blazor 1 Autonomous REST Connector GenAI Agents 1 Chef Habitat Builder 1 Telerik JustDecompile 1 Telerik KendoReact 1 Progress® Telerik® Reporting 1 Telerik UI for WinUI 1 Telerik Test Studio 1 Fiddler Download & Setup Skill 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-8037 Exploited Public exploit EPSS 100%

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

    OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

    Progress Software LoadMaster MOVEit WAF Object Scale Connection Manager
    KEV Aug 7, 2026
  • Critical 9.8
    CVE-2024-6670 Exploited · Ransomware Public exploit EPSS 93%

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

    Progress Software WhatsUp Gold
    KEV Sep 16, 2024
  • Critical 9.8
    CVE-2024-4885 Exploited Public exploit EPSS 99%

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

    Progress Software WhatsUp Gold
    KEV Mar 3, 2025
  • Critical 9.8
    CVE-2024-4358 Exploited Public exploit EPSS 97%

    Registration Authentication Bypass Vulnerability

    In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

    Progress Software Telerik Report Server
    KEV Jun 13, 2024
  • Critical 10.0
    CVE-2024-1212 Exploited Public exploit EPSS 95%

    LoadMaster Pre-Authenticated OS Command Injection

    Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

    Progress Software LoadMaster
    KEV Nov 18, 2024
  • Critical 10.0
    CVE-2023-40044 Exploited · Ransomware Public exploit EPSS 90%

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

    Progress Software WS_FTP Server
    KEV Oct 5, 2023