# Progress vulnerabilities Source: https://junglewise.ai/threats/vendors/progress Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/progress.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 161 vulnerabilities in Progress: 31 in the last 7 days and 107 in the last 90 days, 27 of them critical and 9 exploited in the wild. The most recent, CVE-2026-124702, was published on 12 November 2026. 66 vulnerabilities in the last four weeks, up 633% on the four before (9). 5 critical against 0. 18 technologies have a page of their own. ## Counts - Last 7 days: 31 - Last 30 days: 62 - Last 90 days: 107 - All time: 161 (27 critical, 9 exploited in the wild) ## About Progress Progress is a global software company that provides application development and infrastructure management products. ## Latest Progress vulnerabilities - [CVE-2026-124702: Progress Telerik UI for WPF untrusted URL redirection](https://junglewise.ai/threats/cve-2026-124702-in-telerik-ui-for-wpf-versions-prior-to-2026-4-1110-an-untrusted) (high, CVSS 7.8, published 12 Nov 2026) - [CVE-2026-124700: Telerik UI for WinForms untrusted URL redirection](https://junglewise.ai/threats/cve-2026-124700-in-telerik-ui-for-winforms-versions-prior-to-2026-4-1111-an) (high, CVSS 7.8, published 12 Nov 2026) - [CVE-2026-106154: Progress Telerik UI for ASP.NET Core uncontrolled recursion in FilterParser](https://junglewise.ai/threats/cve-2026-106154-in-progress-telerik-ui-for-asp-net-core-versions-2015-1-318) (high, CVSS 8.6, published 12 Nov 2026) - [CVE-2026-106146: Progress Telerik UI for ASP.NET MVC uncaught exception in filter processing](https://junglewise.ai/threats/cve-2026-106146-in-progress-telerik-ui-for-asp-net-mvc-versions-2012-2-710) (high, CVSS 8.6, published 12 Nov 2026) - [CVE-2026-124698: Progress Telerik Kendo UI for jQuery Chart XSS in tooltip](https://junglewise.ai/threats/cve-2026-124698-in-progress-kendo-ui-for-jquery-the-chart-default-tooltip) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124697: Progress Telerik Kendo UI for jQuery Chart XSS in shared-tooltip](https://junglewise.ai/threats/cve-2026-124697-in-progress-kendo-ui-for-jquery-chart-shared-tooltip-rendering) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124696: Progress Kendo UI for jQuery Spreadsheet XSS in sheet names](https://junglewise.ai/threats/cve-2026-124696-in-progress-kendo-ui-for-jquery-spreadsheet-sheet-names-are) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124695: Progress Telerik Kendo UI jQuery Form cross-site scripting in item hints](https://junglewise.ai/threats/cve-2026-124695-in-progress-kendo-ui-for-jquery-form-the-items-hint-option-is) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124691: Progress Telerik Kendo UI for jQuery Gantt cross-site scripting in Parent dropdown](https://junglewise.ai/threats/cve-2026-124691-in-progress-kendo-ui-for-jquery-gantt-the-task-editor-s-parent) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124705: Progress Telerik UI for .NET MAUI untrusted URL redirection in hyperlink handling](https://junglewise.ai/threats/cve-2026-124705-in-progress-telerik-ui-for-net-maui-prior-to-version-16-0-0-an) (high, CVSS 7.8, published 12 Nov 2026) - [CVE-2026-124704: Telerik UI for WPF deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-124704-in-telerik-ui-for-wpf-versions-prior-to-2026-4-1110-a) (high, CVSS 7.8, published 12 Nov 2026) - [CVE-2026-124703: Telerik UI for WPF improper code generation vulnerability](https://junglewise.ai/threats/cve-2026-124703-in-telerik-ui-for-wpf-versions-prior-to-2026-4-1110-an-improper) (high, CVSS 7.8, published 12 Nov 2026) - [CVE-2026-124701: Telerik UI for WinForms deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-124701-in-telerik-ui-for-winforms-versions-prior-to-2026-4-1111-a) (high, CVSS 7.8, published 12 Nov 2026) - [CVE-2026-124699: Telerik UI for WinForms code generation vulnerability](https://junglewise.ai/threats/cve-2026-124699-in-telerik-ui-for-winforms-versions-prior-to-2026-4-1111-an) (high, CVSS 7.8, published 12 Nov 2026) - [CVE-2026-118975: Progress Telerik Reporting XML external entity injection in SVG processing](https://junglewise.ai/threats/cve-2026-118975-in-progress-telerik-reporting-prior-to-version-20-3-26-1110) (medium, CVSS 6.5, published 12 Nov 2026) - [CVE-2026-106140: Progress Telerik Reporting deserialization vulnerability in .NET report designers](https://junglewise.ai/threats/cve-2026-106140-in-progress-telerik-reporting-prior-to-version-20-3-26-1110-a) (high, CVSS 7.3, published 12 Nov 2026) - [CVE-2026-106156: Progress Telerik UI for ASP.NET Core memory exhaustion via aggregation requests](https://junglewise.ai/threats/cve-2026-106156-in-progress-telerik-ui-for-asp-net-core-versions-2015-1-318) (high, CVSS 8.6, published 11 Nov 2026) - [CVE-2026-106152: Telerik Report Server external control of system configuration setting](https://junglewise.ai/threats/cve-2026-106152-in-progress-telerik-report-server-prior-to-version-12-3-26-1110) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-106137: Progress Telerik UI for ASP.NET MVC class factory denial of service](https://junglewise.ai/threats/cve-2026-106137-in-affected-versions-of-progress-telerik-ui-for-asp-net-mvc-2012) (high, CVSS 8.6, published 11 Nov 2026) - [CVE-2026-106133: Progress Telerik Report Server authorization bypass in Web Report Designer](https://junglewise.ai/threats/cve-2026-106133-in-progress-telerik-report-server-prior-to-version-12-3-26-1110) (medium, CVSS 6.3, published 11 Nov 2026) - [CVE-2026-124694: Progress Kendo UI for jQuery PropertyGrid XSS in bound values](https://junglewise.ai/threats/cve-2026-124694-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124692: Progress Kendo UI for jQuery XSS in Grid column-reorder drag clue](https://junglewise.ai/threats/cve-2026-124692-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124690: Progress Kendo UI for jQuery DOM-based XSS in SVG icon sanitization](https://junglewise.ai/threats/cve-2026-124690-in-progress-kendo-ui-for-jquery-sanitizesvgcontent-parses-custom) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124689: Progress Kendo UI for jQuery ActionSheet XSS in header encoding](https://junglewise.ai/threats/cve-2026-124689-in-progress-kendo-ui-for-jquery-versions-2026-3-1014-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124688: Progress Kendo UI for jQuery XSS in TabStrip, PanelBar, Menu widgets](https://junglewise.ai/threats/cve-2026-124688-in-progress-kendo-ui-for-jquery-prior-to-2026-4-1111-the) (high, CVSS 7.1, published 11 Nov 2026) ## Most severe Progress vulnerabilities - [CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability](https://junglewise.ai/threats/cve-2024-1212-progress-kemp-loadmaster-os-command-injection-vulnerability) (critical, exploited in the wild, CVSS 10, published 18 Nov 2024) - [CVE-2023-40044: Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability](https://junglewise.ai/threats/cve-2023-40044-progress-ws-ftp-server-deserialization-of-untrusted-data) (critical, exploited in the wild, CVSS 10, published 5 Oct 2023) - [CVE-2024-4885: Progress WhatsUp Gold Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-4885-progress-whatsup-gold-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Mar 2025) - [CVE-2024-6670: Progress WhatsUp Gold SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2024-6670-progress-whatsup-gold-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 16 Sep 2024) - [CVE-2024-4358: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability](https://junglewise.ai/threats/cve-2024-4358-progress-telerik-report-server-authentication-bypass-by-spoofing) (critical, exploited in the wild, CVSS 9.8, published 13 Jun 2024) - [CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2023-34362-progress-moveit-transfer-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 2 Jun 2023) - [CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability](https://junglewise.ai/threats/cve-2017-9248-progress-telerik-ui-for-asp-net-ajax-and-sitefinity-cryptographic) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2019-18935: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability](https://junglewise.ai/threats/cve-2019-18935-progress-telerik-ui-for-asp-net-ajax-deserialization-of-untrusted) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021) - [CVE-2026-8037: Progress LoadMaster OS command injection in API](https://junglewise.ai/threats/cve-2026-8037-progress-loadmaster-os-command-injection-in-api) (critical, exploited in the wild, CVSS 9.6, published 4 Jun 2026) - [CVE-2026-80462: Progress Chef Automate API gateway authentication bypass](https://junglewise.ai/threats/cve-2026-80462-progress-chef-automate-api-gateway-authentication-bypass) (critical, CVSS 10, published 11 Sep 2026) ## Vulnerabilities per week 66 vulnerabilities in the last four weeks, up 633% on the four before (9). 5 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 1 | 1 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 8 | 0 | 0 | | 12 Oct 2026 | 58 | 5 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 6 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 29 | 0 | 0 | ## Progress technologies - [Progress Marklogic Server](https://junglewise.ai/threats/technologies/marklogic-server): 41 vulnerabilities - [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer): 26 vulnerabilities - [Progress Kendo UI for jQuery](https://junglewise.ai/threats/technologies/kendo-ui-for-jquery): 25 vulnerabilities - [Progress WhatsUp Gold](https://junglewise.ai/threats/technologies/whatsup-gold): 7 vulnerabilities - [Progress LoadMaster](https://junglewise.ai/threats/technologies/loadmaster): 6 vulnerabilities - [Progress Sitefinity](https://junglewise.ai/threats/technologies/sitefinity): 6 vulnerabilities - [Progress ADC](https://junglewise.ai/threats/technologies/adc): 5 vulnerabilities - [Progress Connection Manager for ObjectScale](https://junglewise.ai/threats/technologies/connection-manager-for-objectscale): 5 vulnerabilities - [Progress ECS Connection Manager](https://junglewise.ai/threats/technologies/ecs-connection-manager): 5 vulnerabilities - [Progress Telerik Document Processing Libraries](https://junglewise.ai/threats/technologies/telerik-document-processing-libraries): 5 vulnerabilities - [Progress Telerik Report Server](https://junglewise.ai/threats/technologies/telerik-report-server): 5 vulnerabilities - [Progress ShareFile Storage Zones Controller](https://junglewise.ai/threats/technologies/progress-sharefile-storage-zones-controller): 4 vulnerabilities - [Progress Kendo Ui](https://junglewise.ai/threats/technologies/kendo-ui): 3 vulnerabilities - [Progress Telerik Fiddler Classic](https://junglewise.ai/threats/technologies/telerik-fiddler-classic): 3 vulnerabilities - [Progress Telerik Ui For Asp.net Ajax](https://junglewise.ai/threats/technologies/telerik-ui-for-asp-net-ajax): 3 vulnerabilities - [Progress Telerik UI for WinForms](https://junglewise.ai/threats/technologies/telerik-ui-for-winforms): 3 vulnerabilities - [Progress Telerik UI for WPF](https://junglewise.ai/threats/technologies/telerik-ui-for-wpf): 3 vulnerabilities - [Progress WS FTP Server](https://junglewise.ai/threats/technologies/ws-ftp-server): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Progress vulnerabilities", https://junglewise.ai/threats/vendors/progress, 13 November 2026.