https://vulnogram.org/ Most recent CVEs assigned by Progress Software Corporation (progresssoftware). https://vulnogram.org/seaview/icons/progresssoftware.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-108116 https://vulnogram.org/CVE-2026-108116 In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XML… High Network Exploitable Thu, 15 Oct 2026 14:12:52 GMT https://vulnogram.org/CVE-2026-106153 https://vulnogram.org/CVE-2026-106153 In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who… Medium Thu, 15 Oct 2026 14:12:05 GMT https://vulnogram.org/CVE-2026-106151 https://vulnogram.org/CVE-2026-106151 In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message… Medium Thu, 15 Oct 2026 14:11:08 GMT https://vulnogram.org/CVE-2026-106150 https://vulnogram.org/CVE-2026-106150 In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or e… Medium Thu, 15 Oct 2026 14:09:50 GMT https://vulnogram.org/CVE-2026-106149 https://vulnogram.org/CVE-2026-106149 In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields ca… Medium Thu, 15 Oct 2026 14:08:43 GMT https://vulnogram.org/CVE-2026-106148 https://vulnogram.org/CVE-2026-106148 In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject… Medium Thu, 15 Oct 2026 13:28:22 GMT https://vulnogram.org/CVE-2026-106147 https://vulnogram.org/CVE-2026-106147 In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML… Medium Thu, 15 Oct 2026 13:27:32 GMT https://vulnogram.org/CVE-2026-106161 https://vulnogram.org/CVE-2026-106161 In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data b… Medium Thu, 15 Oct 2026 13:26:57 GMT https://vulnogram.org/CVE-2026-106160 https://vulnogram.org/CVE-2026-106160 In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by… Medium Thu, 15 Oct 2026 13:24:33 GMT https://vulnogram.org/CVE-2026-106159 https://vulnogram.org/CVE-2026-106159 In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can suppl… Medium Network Exploitable Thu, 15 Oct 2026 13:23:40 GMT https://vulnogram.org/CVE-2026-106158 https://vulnogram.org/CVE-2026-106158 In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource colo… Medium Network Exploitable Thu, 15 Oct 2026 13:22:44 GMT https://vulnogram.org/CVE-2026-106157 https://vulnogram.org/CVE-2026-106157 In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item… Medium Network Exploitable Thu, 15 Oct 2026 13:21:27 GMT https://vulnogram.org/CVE-2026-106162 https://vulnogram.org/CVE-2026-106162 In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An at… Medium Network Exploitable Thu, 15 Oct 2026 13:20:11 GMT https://vulnogram.org/CVE-2026-106163 https://vulnogram.org/CVE-2026-106163 In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name… Medium Network Exploitable Thu, 15 Oct 2026 13:18:53 GMT https://vulnogram.org/CVE-2026-89077 https://vulnogram.org/CVE-2026-89077 Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:16:24 GMT https://vulnogram.org/CVE-2026-89076 https://vulnogram.org/CVE-2026-89076 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:15:23 GMT https://vulnogram.org/CVE-2026-89075 https://vulnogram.org/CVE-2026-89075 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:14:28 GMT https://vulnogram.org/CVE-2026-89074 https://vulnogram.org/CVE-2026-89074 Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:12:49 GMT https://vulnogram.org/CVE-2026-89073 https://vulnogram.org/CVE-2026-89073 Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Network Exploitable Wed, 14 Oct 2026 15:11:30 GMT https://vulnogram.org/CVE-2026-89072 https://vulnogram.org/CVE-2026-89072 Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:10:40 GMT https://vulnogram.org/CVE-2026-89071 https://vulnogram.org/CVE-2026-89071 Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:09:45 GMT https://vulnogram.org/CVE-2026-89070 https://vulnogram.org/CVE-2026-89070 Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Network Exploitable Wed, 14 Oct 2026 15:08:46 GMT https://vulnogram.org/CVE-2026-89069 https://vulnogram.org/CVE-2026-89069 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:07:00 GMT https://vulnogram.org/CVE-2026-89068 https://vulnogram.org/CVE-2026-89068 Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Network Exploitable Wed, 14 Oct 2026 15:06:13 GMT https://vulnogram.org/CVE-2026-89067 https://vulnogram.org/CVE-2026-89067 Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:05:26 GMT https://vulnogram.org/CVE-2026-87093 https://vulnogram.org/CVE-2026-87093 Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4. High Wed, 14 Oct 2026 15:04:16 GMT https://vulnogram.org/CVE-2026-85976 https://vulnogram.org/CVE-2026-85976 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side respons… Medium Mon, 12 Oct 2026 16:56:54 GMT https://vulnogram.org/CVE-2026-85975 https://vulnogram.org/CVE-2026-85975 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected… High Network Exploitable Mon, 12 Oct 2026 16:52:30 GMT https://vulnogram.org/CVE-2026-85974 https://vulnogram.org/CVE-2026-85974 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or m… High Network Exploitable Mon, 12 Oct 2026 16:50:49 GMT https://vulnogram.org/CVE-2026-85973 https://vulnogram.org/CVE-2026-85973 Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection. High Network Exploitable Mon, 12 Oct 2026 16:49:57 GMT https://vulnogram.org/CVE-2026-85972 https://vulnogram.org/CVE-2026-85972 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker… High Network Exploitable Mon, 12 Oct 2026 16:41:15 GMT https://vulnogram.org/CVE-2026-85971 https://vulnogram.org/CVE-2026-85971 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissi… High Mon, 12 Oct 2026 16:40:22 GMT https://vulnogram.org/CVE-2026-85970 https://vulnogram.org/CVE-2026-85970 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files. High Mon, 12 Oct 2026 16:39:27 GMT https://vulnogram.org/CVE-2026-85969 https://vulnogram.org/CVE-2026-85969 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause… High Mon, 12 Oct 2026 16:37:54 GMT https://vulnogram.org/CVE-2026-85968 https://vulnogram.org/CVE-2026-85968 Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limi… High Mon, 12 Oct 2026 16:37:16 GMT https://vulnogram.org/CVE-2026-85967 https://vulnogram.org/CVE-2026-85967 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which c… Medium Network Exploitable Mon, 12 Oct 2026 16:32:39 GMT https://vulnogram.org/CVE-2026-85966 https://vulnogram.org/CVE-2026-85966 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this… High Mon, 12 Oct 2026 16:31:32 GMT https://vulnogram.org/CVE-2026-85965 https://vulnogram.org/CVE-2026-85965 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability. High Mon, 12 Oct 2026 16:30:00 GMT https://vulnogram.org/CVE-2026-85964 https://vulnogram.org/CVE-2026-85964 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files… High Mon, 12 Oct 2026 16:29:18 GMT https://vulnogram.org/CVE-2026-85963 https://vulnogram.org/CVE-2026-85963 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services… High Network Exploitable Mon, 12 Oct 2026 16:28:11 GMT https://vulnogram.org/CVE-2026-85962 https://vulnogram.org/CVE-2026-85962 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the… High Network Exploitable Mon, 12 Oct 2026 16:12:26 GMT https://vulnogram.org/CVE-2026-85961 https://vulnogram.org/CVE-2026-85961 On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affec… High Network Exploitable Mon, 12 Oct 2026 16:10:53 GMT https://vulnogram.org/CVE-2026-85960 https://vulnogram.org/CVE-2026-85960 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests… High Network Exploitable Mon, 12 Oct 2026 16:09:50 GMT https://vulnogram.org/CVE-2026-85959 https://vulnogram.org/CVE-2026-85959 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or cre… High Network Exploitable Mon, 12 Oct 2026 16:08:48 GMT https://vulnogram.org/CVE-2026-85958 https://vulnogram.org/CVE-2026-85958 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in… High Network Exploitable Mon, 12 Oct 2026 16:02:09 GMT https://vulnogram.org/CVE-2026-85957 https://vulnogram.org/CVE-2026-85957 Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure. High Network Exploitable Mon, 12 Oct 2026 16:01:34 GMT https://vulnogram.org/CVE-2026-85956 https://vulnogram.org/CVE-2026-85956 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, w… Critical Mon, 12 Oct 2026 16:00:29 GMT https://vulnogram.org/CVE-2026-85955 https://vulnogram.org/CVE-2026-85955 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result… Critical Mon, 12 Oct 2026 15:59:28 GMT https://vulnogram.org/CVE-2026-85954 https://vulnogram.org/CVE-2026-85954 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation be… High Network Exploitable Mon, 12 Oct 2026 15:58:40 GMT https://vulnogram.org/CVE-2026-85953 https://vulnogram.org/CVE-2026-85953 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unau… High Mon, 12 Oct 2026 15:58:02 GMT