Vendor
Progress Software
156 known vulnerabilities in products by Progress Software, 2 of them actively exploited (CISA KEV).
Key figures
156
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
26
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-8037 | Progress LoadMaster Command Injection Vulnerability In CISA KEValso in 4 other products | 9.6 | |
| Critical | CVE-2024-1212 | LoadMaster Pre-Authenticated OS Command Injection In CISA KEValso in 1 other product | 10.0 | |
| High | CVE-2025-1094 | PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation | 8.1 | |
| Critical | CVE-2025-8868 | Chef Automate compliance service SQL Injection Vulnerability | 9.8 | |
| Critical | CVE-2024-2389 | Flowmon Unauthenticated Command Injection Vulnerability | 10.0 | |
| Critical | CVE-2026-4670 | Improper Authentication vulnerability in Progress MOVEit Automation | 9.8 | |
| High | CVE-2025-13447 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster | 8.4 | |
| High | CVE-2025-13444 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster | 8.4 | |
| Critical | CVE-2026-91140 | OS command injection in Progress Software Autonomous REST Connector GenAI Agents | 9.6 | |
| Critical | CVE-2026-80462 | Privilege Escalation in Progress Chef Automate | 10.0 | |
| High | CVE-2026-3518 | Progress Software LoadMaster: Command Injection | 7.2 | |
| High | CVE-2026-3517 | Progress Software LoadMaster: Command Injection | 7.2 | |
| High | CVE-2024-2448 | LoadMaster Command Injection Vulnerability | 8.4 | |
| High | CVE-2026-5174 | Improper Access Control Vulnerability in Progress MOVEit Automation | 8.8 | |
| Critical | CVE-2026-90868 | OS Command Injection in Progress WS_FTP Server | 9.9 | |
| High | CVE-2025-3600 | Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX | 7.5 | |
| High | CVE-2024-2449 | LoadMaster Cross-Site Request Forgery (CSRF) | 7.5 | |
| High | CVE-2026-59688 | Progress Software LoadMaster: OS Command Injection | 8.4 | |
| High | CVE-2026-59686 | Progress Software LoadMaster: OS Command Injection | 8.4 | |
| High | CVE-2026-59687 | Progress Software LoadMaster: OS Command Injection | 8.4 | |
| Critical | CVE-2026-90865 | Command Injection via FTP Notification Variables in Progress WS_FTP Server | 9.0 | |
| High | CVE-2026-3519 | Progress Software LoadMaster: Command Injection | 7.2 | |
| High | CVE-2026-4048 | Progress Software LoadMaster: Command Injection | 7.2 | |
| Critical | CVE-2026-90866 | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server | 9.1 | |
| Critical | CVE-2026-84295 | Improper Authentication in Progress WS_FTP Server | 10.0 |
News
- Progress Kemp LoadMaster Flaw Exploited; SonicWall SMA1000 Flaws Exploited in Ransomwaresans-newsbites-mail,
- Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attemptsthehackernews,
- Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attemptsthehackernews,
- Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auththehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 23sans-atrisk-mail,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 20sans-atrisk,