Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how progress software compares to other vendors in security performance

View Risk Score →

Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-GeneratorOS command injection in Progress Software Autonomous REST Connector GenAI Agents

Risk 80
Severity
9.6
OS Command Injection, Command Injection
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

First published (updated )
CVE-2026-91140

Progress Software Fiddler EverywhereMissing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

Risk 56
Severity
7.7
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

First published (updated )
CVE-2026-86158

Progress Software Kemp LoadMasterZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability

Risk 69

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
ZDI-CAN-31117

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability

Risk 66

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
Advisory
ZDI-26-646

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster access Missing Authorization Privilege Escalation Vulnerability

Risk 68

This vulnerability allows remote attackers to escalate privileges on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-59690.

First published (updated )
Advisory
ZDI-26-481

Progress Software Kemp LoadMasterZDI-26-481: Progress Software Kemp LoadMaster access Missing Authorization Privilege Escalation Vulnerability

Risk 68

This vulnerability allows remote attackers to escalate privileges on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-59690.

First published (updated )
ZDI-CAN-30735

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster enablexroot Use of Hard-Coded Cryptographic Key Privilege Escalation Vulnerability

Risk 64

This vulnerability allows remote attackers to escalate privileges on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-59689.

First published (updated )
Advisory
ZDI-26-482

Progress Software Kemp LoadMasterZDI-26-482: Progress Software Kemp LoadMaster enablexroot Use of Hard-Coded Cryptographic Key Privilege Escalation Vulnerability

Risk 63

This vulnerability allows remote attackers to escalate privileges on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-59689.

First published (updated )
ZDI-CAN-30687

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster dodelapikey Uninitialized Memory Remote Code Execution Vulnerability

Risk 73

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
Advisory
ZDI-26-340

Progress Software Kemp LoadMasterZDI-26-340: Progress Software Kemp LoadMaster dodelapikey Uninitialized Memory Remote Code Execution Vulnerability

Risk 73

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
ZDI-CAN-30438

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster dolistapikeys Uninitialized Memory Remote Code Execution Vulnerability

Risk 71

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
Advisory
ZDI-26-341

Progress Software Kemp LoadMasterZDI-26-341: Progress Software Kemp LoadMaster dolistapikeys Uninitialized Memory Remote Code Execution Vulnerability

Risk 66

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
ZDI-CAN-30439

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster apiuser Uninitialized Memory Remote Code Execution Vulnerability

Risk 95

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
Advisory
ZDI-26-342

Progress Software Kemp LoadMasterZDI-26-342: Progress Software Kemp LoadMaster apiuser Uninitialized Memory Remote Code Execution Vulnerability

Risk 95

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-8037.

First published (updated )
ZDI-CAN-30437

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster addcountry Command Injection Remote Code Execution Vulnerability

Risk 71

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3517.

First published (updated )
Advisory
ZDI-26-319

Progress Software Kemp LoadMasterZDI-26-319: Progress Software Kemp LoadMaster addcountry Command Injection Remote Code Execution Vulnerability

Risk 72

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3517.

First published (updated )
ZDI-CAN-29249

Progress Software Kemp LoadMasterZDI-26-318: Progress Software Kemp LoadMaster ssodomain_killsession Command Injection Remote Code Execution Vulnerability

Risk 73

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3518.

First published (updated )
ZDI-CAN-29222

Progress Software Kemp LoadMasterProgress Software Kemp LoadMaster ssodomain_killsession Command Injection Remote Code Execution Vulnerability

Risk 79

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3518.

First published (updated )
Advisory
ZDI-26-318

Progress Software MOVEit AutomationAllocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation

Risk 31
Severity
7.5
EPSS
0.36%
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

First published (updated )
CVE-2026-8488

Progress Software MOVEit AutomationIncorrect default permissions vulnerability in Progress Software MOVEit Automation

Risk 31
Severity
7.5
EPSS
0.28%
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

First published (updated )
CVE-2026-8487

Progress Software MOVEit AutomationAllocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation

Risk 31
Severity
7.5
EPSS
0.40%
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

First published (updated )
CVE-2026-8486

Progress Software MOVEit AutomationUncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation

Risk 31
Severity
7.5
EPSS
0.35%
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

First published (updated )
CVE-2026-8485

Progress Software MOVEit AutomationImproper Access Control Vulnerability in Progress MOVEit Automation

Risk 82
Severity
8.8
Input Validation
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.

This issue affects MOVEit Automation: from 2025.1.0 before 2025.1.5, from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

First published (updated )
CVE-2026-5174

Progress Software MOVEit AutomationImproper Authentication vulnerability in Progress MOVEit Automation

Risk 89
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.

This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.

First published (updated )
CVE-2026-4670

Progress Software OpenEdgeRecoverable obfuscation using the OECH1 prefix encoding in OpenEdge

Risk 84
Severity
9.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:M/U:Red

The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform.  It has been identified as cryptographically weak and unsuitable for stored encodings and enterprise applications.  OECH1 encodings should be considered exploitable and immediately replaced by any other supported prefix encoding, all of which are based on symmetric encryption.

First published (updated )
CVE-2025-8095

Progress Software Kemp LoadMasterZDI-26-055: Progress Software Kemp LoadMaster addapikey Command Injection Remote Code Execution Vulnerability

Risk 43

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.4. The following CVEs are assigned: CVE-2025-13447.

First published (updated )
ZDI-CAN-27596

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203