By year
00
01
02
03
04
07
08
12
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Progress flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-8037 Progress LoadMaster Command InjectionExploited since Aug 7, 2026 · CVSS 9.6
- CVE-2024-4885 Progress WhatsUp Gold Path TraversalExploited since Mar 3, 2025 · CVSS 9.8
- CVE-2024-1212 Progress Kemp LoadMaster OS Command InjectionExploited since Nov 18, 2024 · CVSS 10
- CVE-2024-6670 Progress WhatsUp Gold SQL InjectionExploited since Sep 16, 2024 · ransomware · CVSS 9.8
- CVE-2024-4358 Progress Telerik Report Server Authentication Bypass by SpoofingExploited since Jun 13, 2024 · CVSS 9.8
- CVE-2023-40044 Progress WS_FTP Server Deserialization of Untrusted DataExploited since Oct 5, 2023 · ransomware · CVSS 10
- CVE-2023-34362 Progress MOVEit Transfer SQL InjectionExploited since Jun 2, 2023 · ransomware · CVSS 9.8
- CVE-2019-18935 Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted DataExploited since Nov 3, 2021 · ransomware · CVSS 9.8
- CVE-2017-9248 Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic WeaknessExploited since Nov 3, 2021 · CVSS 9.8
Latest high and critical flaws
- CVE-2026-118040 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate valHigh 7.5 · Oct 28, 2026
- CVE-2026-118039 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows High 7.5 · Oct 28, 2026
- CVE-2026-118038 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows High 7.1 · Oct 28, 2026
- CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficienHigh 7.5 · Oct 28, 2026
- CVE-2026-118036 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and High 7.5 · Oct 28, 2026
- CVE-2026-118035 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vHigh 7.5 · Oct 28, 2026
- CVE-2026-108116 In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML High 7.5 · Oct 15, 2026
- CVE-2026-89077 Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module).High 7.5 · Oct 14, 2026
- CVE-2026-89076 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module).High 7.2 · Oct 14, 2026
- CVE-2026-89075 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer.High 7.3 · Oct 14, 2026
- CVE-2026-89074 Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer.High 7.5 · Oct 14, 2026
- CVE-2026-89073 Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.High 7.5 · Oct 14, 2026
- CVE-2026-89072 Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).High 7.5 · Oct 14, 2026
- CVE-2026-89071 Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module).High 7.5 · Oct 14, 2026
- CVE-2026-89070 Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module).High 7.5 · Oct 14, 2026
- CVE-2026-89069 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).High 8 · Oct 14, 2026
- CVE-2026-89068 Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).High 8.1 · Oct 14, 2026
- CVE-2026-89067 Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.High 8.8 · Oct 14, 2026
- CVE-2026-87093 Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer.High 8.8 · Oct 14, 2026
- CVE-2026-85975 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default.High 7.5 · Oct 12, 2026
- CVE-2026-85974 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbounHigh 7.4 · Oct 12, 2026
- CVE-2026-85973 Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications.High 7.4 · Oct 12, 2026
- CVE-2026-85972 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication serviHigh 7.4 · Oct 12, 2026
- CVE-2026-85971 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log filesHigh 7.1 · Oct 12, 2026
- CVE-2026-85970 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths,High 7.1 · Oct 12, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.