ProgressSoftware

Latest CVEs · RSS

• CVE-2026-108116 2026-10-15 · CVSS 7.5
  In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML
• CVE-2026-106153 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title withou
• CVE-2026-106151 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attribut
• CVE-2026-106150 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting w
• CVE-2026-106149 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation with
• CVE-2026-106148 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image
• CVE-2026-106147 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField val
• CVE-2026-106161 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without e
• CVE-2026-106160 2026-10-15 · CVSS 5.4
  In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths co
• CVE-2026-106159 2026-10-15 · CVSS 4.7
  In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted
• CVE-2026-106158 2026-10-15 · CVSS 4.7
  In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted eve
• CVE-2026-106157 2026-10-15 · CVSS 4.7
  In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a
• CVE-2026-106162 2026-10-15 · CVSS 4.7
  In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as
• CVE-2026-106163 2026-10-15 · CVSS 6.5
  In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supp
• CVE-2026-89077 2026-10-14 · CVSS 7.5
  Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1
• CVE-2026-89076 2026-10-14 · CVSS 7.2
  Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This is
• CVE-2026-89075 2026-10-14 · CVSS 7.3
  Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 befo
• CVE-2026-89074 2026-10-14 · CVSS 7.5
  Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2
• CVE-2026-89073 2026-10-14 · CVSS 7.5
  Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.
• CVE-2026-89072 2026-10-14 · CVSS 7.5
  Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 20
• CVE-2026-89071 2026-10-14 · CVSS 7.5
  Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affect
• CVE-2026-89070 2026-10-14 · CVSS 7.5
  Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2
• CVE-2026-89069 2026-10-14 · CVSS 8.0
  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affe
• CVE-2026-89068 2026-10-14 · CVSS 8.1
  Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2
• CVE-2026-89067 2026-10-14 · CVSS 8.8
  Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and fro