CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight and non-default site configuration.
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.
CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user interaction and a non-default site configuration.
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.
This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
CVE-2026-5174 is an improper input validation vulnerability in Progress Software MOVEit Automation that allows privilege escalation. It affects multiple versions of MOVEit Automation released from 2024.0.0 up to versions prior to 2025.1.5. The vulnerability has a high severity rating with a CVSS score of 7.7. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild at this time.
CVE-2026-4670 is a critical authentication bypass vulnerability in Progress Software MOVEit Automation affecting versions from 2024.0.0 before 2024.1.8 and from 2025.0.0 before 2025.0.9. This vulnerability allows an attacker to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state, a server-side remote code execution is possible.
CVE-2026-6022 is a high-severity vulnerability in Progress Software's Telerik UI for ASP. NET AJAX prior to version 2026.1.421. The RadAsyncUpload component improperly enforces file upload size limits during chunk reassembly, allowing attackers to upload files exceeding the configured maximum size. This uncontrolled resource consumption can lead to disk space exhaustion on the affected system. There is no official patch or remediation level currently confirmed. No known exploits are reported in the wild. The vulnerability impacts availability but does not affect confidentiality or integrity.
OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in a custom WAF rule file during the file upload process.
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “VS Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'aclcontrol' command
CVE-2026-3518 is a high-severity OS command injection vulnerability in the API of Progress Software LoadMaster version 7.2.37.0. It allows an authenticated attacker with full permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the 'killsession' command. The vulnerability requires authentication with high privileges and does not involve user interaction. No official patch or remediation guidance has been published yet.
CVE-2026-3517 is a high-severity OS command injection vulnerability in Progress Software LoadMaster version 7.1.32.0. It affects the API component of the product, allowing an authenticated attacker with 'Geo Administration' permissions to execute arbitrary commands on the LoadMaster appliance. The vulnerability arises from unsanitized input in the 'addcountry' command. There is no official patch or remediation level currently confirmed by the vendor. No known exploits are reported in the wild at this time.
The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications. OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.
A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server
through the adopted authority of the AdminServer process itself. The delegated authority of the AdminServer could allow its users the ability to read arbitrary files on the host system through the misuse of the setFile() and openFile()
methods exposed through the RMI interface. Misuse was limited only by OS-level authority of the AdminServer's elevated
privileges granted and the user's access to these methods enabled through RMI. The exploitable methods have been removed thus eliminating their access through RMI or downstream of the RMI registry.
CVE-2026-2737 is a high-severity cross-site scripting (XSS) vulnerability in Progress Software Flowmon versions prior to 12.5.8 and 13.0.6. It allows an attacker to craft a malicious link that, if clicked by an administrator, can trigger unintended actions within their authenticated web session. This vulnerability requires user interaction and low privileges but can lead to high impact on confidentiality, integrity, and availability. No official patch information is provided in the available data.
CVE-2026-3692 is a high-severity OS command injection vulnerability in Progress Software Flowmon versions prior to 12.5.8. It allows an authenticated low-privileged user to craft a malicious request during report generation that can execute unintended commands on the server. This vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78). No known exploits are reported in the wild. There is no explicit vendor advisory or patch information provided, so patch status is not confirmed.