progress security advisories
24 threat alerts tracking vulnerabilities and security advisories that affect progress products.
Vulnios monitors progress CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent progress security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-12108 — progress, microsoft — whatsup_gold, windows
In WhatsUp Gold versions released before 2024.0.2, an attacker can gain access to the WhatsUp Gold server via the public API.
criticalCVE-2024-12108Critical Vulnerability: CVE-2024-6671 — progress — whatsup_gold
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encr
criticalCVE-2024-6671Critical Vulnerability: CVE-2024-5805 — progress — moveit_gateway
Improper Authentication vulnerability in Progress MOVEit Gateway (SFTP modules) allows Authentication Bypass.This issue affects MOVEit Gateway: 2024.0.0.
criticalCVE-2024-5805Critical Vulnerability: CVE-2026-9190 — progress — marklogic_server
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack
criticalCVE-2026-9190Critical Vulnerability: CVE-2026-7329 — progress — marklogic_server
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privile
criticalCVE-2026-7329Critical Vulnerability: CVE-2026-9192 — progress — marklogic_server
An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execut
criticalCVE-2026-9192Critical Vulnerability: CVE-2026-7557 — progress — marklogic_server
An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to b
criticalCVE-2026-7557Critical Vulnerability: CVE-2026-8709 — progress — marklogic_server
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST ro
criticalCVE-2026-8709Critical Vulnerability: CVE-2026-9195 — progress — marklogic_server
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to ex
criticalCVE-2026-9195Critical Vulnerability: CVE-2026-9193 — progress — marklogic_server
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalat
criticalCVE-2026-9193Critical Vulnerability: CVE-2026-8037 — progress — connection_manager_for_objectscale, ecs_connection_manager
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting uns
criticalCVE-2026-8037Critical Vulnerability: CVE-2026-7312 — progress — sitefinity
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441
criticalCVE-2026-7312Critical Vulnerability: CVE-2026-7198 — progress — sitefinity
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in fu
criticalCVE-2026-7198Critical Vulnerability: CVE-2021-38159 — progress — moveit_transfer
In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow an unauthenticated remote attacker to gain access to the dat
criticalCVE-2021-38159Critical Vulnerability: CVE-2021-28141 — progress — telerik_ui_for_asp.net_ajax
An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attack
criticalCVE-2021-28141Critical Vulnerability: CVE-2019-19790 — progress, telerik — telerik_ui_for_asp.net_ajax, radchart
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server throug
criticalCVE-2019-19790Critical Vulnerability: CVE-2019-17392 — progress — sitefinity
Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.
criticalCVE-2019-17392Critical Vulnerability: CVE-2018-8938 — progress — whatsup_gold
A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 (18.0). Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execut
criticalCVE-2018-8938Critical Vulnerability: CVE-2018-8939 — progress — whatsup_gold
An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 (18.0). Malicious actors can submit specially crafted requests via the NmAPI executable to (1) gain unauthorized access t
criticalCVE-2018-8939Critical Vulnerability: CVE-2018-5777 — progress — whatsup_gold
An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Remote clients can take advantage of a misconfiguration in the TFTP server that could allow attackers to execute arbitra
criticalCVE-2018-5777Critical Vulnerability: CVE-2018-5778 — progress — whatsup_gold
An issue was discovered in Ipswitch WhatsUp Gold before 2017 Plus SP1 (17.1.1). Multiple SQL injection vulnerabilities are present in the legacy .ASP pages, which could allow attackers to execute arbi
criticalCVE-2018-5778Critical Vulnerability: CVE-2017-15883 — progress — sitefinity
Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to bypass authentication and consequently cause a denial of service on load balanced sites or gain privileges via vec
criticalCVE-2017-15883Critical Vulnerability: CVE-2015-9245 — progress — openedge
Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malicious Java classes via
criticalCVE-2015-9245Critical Vulnerability: CVE-2015-8261 — progress — whatsup_gold
The DroneDeleteOldMeasurements implementation in Ipswitch WhatsUp Gold before 16.4 does not properly validate serialized XML objects, which allows remote attackers to conduct SQL injection attacks via
criticalCVE-2015-8261
Track progress exposure across your environment
Vulnios automatically cross-references your asset inventory against new progress CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan