How many CVEs does Progress have?

Progress has 289 published CVE records since 2000, including 76 in the last two years.

How many Progress CVEs are in CISA KEV?

Yes — 10 of Progress's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Progress products have the most CVEs?

The Progress products with the most published CVEs are WhatsUp Gold, MOVEit Transfer, WS_FTP Server, Sitefinity, LoadMaster.

What are the most common weakness types in Progress CVEs?

Progress's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-502 (Deserialization of Untrusted Data), CWE-20 (Improper Input Validation).

Are there public exploits for Progress vulnerabilities?

Yes — 58 of Progress's CVEs have a known public exploit.

How many critical Progress vulnerabilities are there?

Progress has 70 critical and 153 high-severity CVEs.

What is the average severity of Progress CVEs?

The average CVSS base score across Progress's scored CVEs is 7.9.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

289 CVEs

10 in CISA KEV

Progress Vulnerabilities

Name: Progress vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Progress.

289

Total CVEs

Published

10

In CISA KEV

Exploited in the wild

58

Public exploits

PoC or exploit code

7.9

Avg CVSS

2000–2026

Overview

Progress has 289 published CVE records since 2000, of which 10 are in CISA's Known Exploited Vulnerabilities catalog and 58 have a known public exploit. The average CVSS base score across scored CVEs is 7.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Progress products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Progress's vulnerability posture, as a share of its 289 published CVEs.

Average CVSS: 7.9
Critical / high: 77%
Actively exploited (KEV): 3%
Public exploit available: 20%
Patch available: 77%

Severity and exploitation

How the CVSS severity of Progress's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical70

High153

Medium66

Low0

In CISA’s Known Exploited Vulnerabilities catalog

10

10 of Progress's CVEs are confirmed exploited in the wild.

Public exploits

58

58 of Progress's CVEs have a known public exploit available.

Most affected products

The Progress products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Progress CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Progress CVE records.

Disclosure activity by year

How many Progress CVEs were published each year.

2019

7

2020

5

2021

6

2022

8

2023

39

2024

90

2025

34

2026

42

Latest Progress CVEs

The most recently disclosed vulnerabilities affecting Progress.

File Extension Restriction Bypass in MOVEit Transfer
CWE-46
Critical · CVSS 9.8
EPSS 0.3%2026-07-08
Cross-Org External Token Metadata accessible to AuditUser role
CWE-863
High · CVSS 8.8
EPSS 0.2%2026-07-08
IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer
CWE-290
High · CVSS 7.5
EPSS 0.2%2026-07-08
Authenticated Path Traversal allows MOVEit admins to view arbitrary system files
CWE-23
High · CVSS 7.5
EPSS 0.4%2026-07-08
Institution scope bypass vulnerability in custom reports
CWE-943
Critical · CVSS 9.8
EPSS 0.2%2026-07-08
Stored XSS in MOVEit Transfer Ad Hoc module
CWE-79
High · CVSS 8.0
EPSS 0.2%2026-07-08
Memory leak in SFTP service can result in a denial of service in MOVEit Transfer
CWE-401
High · CVSS 7.5
EPSS 0.3%2026-07-08
Table scope bypass vulnerability in custom reports
CWE-943
High · CVSS 7.2
EPSS 0.4%2026-07-08
Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon
CWE-863
High · CVSS 8.7
EPSS 0.2%2026-07-02
Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
CWE-89
High · CVSS 8.7
EPSS 0.2%2026-07-02
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
CWE-77
Critical · CVSS 9.8
EPSS 43.4%2026-06-04
CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
High · CVSS 8.7
EPSS 0.3%2026-06-02

Track new Progress CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Progress CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

sourceware297 CVEs discourse296 CVEs Open-Xchange293 CVEs Eclipse Foundation290 CVEs PDF-XChange289 CVEs Splunk287 CVEs xwiki285 CVEs Mayuri K276 CVEs

Browse all vendors

Frequently asked questions

Common questions about Progress vulnerabilities.

How many CVEs does Progress have?: Progress has 289 published CVE records since 2000, including 76 in the last two years.
How many Progress CVEs are in CISA KEV?: Yes — 10 of Progress's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Progress products have the most CVEs?: The Progress products with the most published CVEs are WhatsUp Gold, MOVEit Transfer, WS_FTP Server, Sitefinity, LoadMaster.
What are the most common weakness types in Progress CVEs?: Progress's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-502 (Deserialization of Untrusted Data), CWE-20 (Improper Input Validation).
Are there public exploits for Progress vulnerabilities?: Yes — 58 of Progress's CVEs have a known public exploit.
How many critical Progress vulnerabilities are there?: Progress has 70 critical and 153 high-severity CVEs.
What is the average severity of Progress CVEs?: The average CVSS base score across Progress's scored CVEs is 7.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Progress vulnerabilities

Monitor new Progress vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing