Progress Software · weakness class
Access Control
41 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 1
Every one of the 41 is a mark on the map. Named now: 1 to 26, most at risk first.
- WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability
- WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability
- An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This…
- Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URLs from which to load and execute malici…
- In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization contro…
- MOVEit Transfer Group Admin Privilege Escalation
- Improper privilege management in Progress MarkLogic Server xdmp:eval-in
- Privilege escalation in Progress MarkLogic Server REST query interfaces
- Incorrect access control in the Sitefinity backend
- Privilege escalation in Progress MarkLogic Server Hadoop integration
- Privilege escalation in Progress MarkLogic Server REST document patch operation
- Improper privilege management in Progress MarkLogic Server Management API
- Improper privilege management in Progress MarkLogic Server forest operations
- CWE-284: Improper Access Control in web services in Progress Sitefinity
- Improper Access Control of Web Admin Console in Progress WS_FTP Server
- Improper privilege management in Progress MarkLogic Server backup and restore operations
- Privilege escalation in Progress MarkLogic Server REST API document processing
- Cross-Org External Token Metadata accessible to AuditUser role
- WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
- Improper privilege management in Progress MarkLogic Server REST extensions
- Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon
- Incorrect default permissions vulnerability in Progress Software MOVEit Automation
- The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token
- Insufficient isolation of user-supplied code in Progress MarkLogic Server
- Incorrect Authorization in Telerik Report Server Web Report Designer
- A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.