PS
Vendor security profile1 actively exploited CVEs
Progress Software
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs17
Critical3
CISA KEV1
Public exploit1
Patch rate%12
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
0
0
0
0
1
0
0
5
11
CVE KEV
CVE severity distribution
17toplam CVE
Critical3 (18%)
High8 (47%)
Medium5 (29%)
Low1 (6%)
Patch and exploitation view
%12
Verified patch
%6
CISA KEV
%6
Public exploit
2Patch available
0Partial
0Workaround
0Vendor: no patch
15Unknown
Latest vulnerabilities
5.4
CVE-2026-106139
Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue
PS
Patch status unknownEPSS %0
5.4
CVE-2026-106138
Cross-Site Scripting via Chart Tooltip in KendoReact
PS
Patch status unknownEPSS %0
8.9
CVE-2026-106155
Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers
PS
Patch status unknownEPSS %0
7.1
CVE-2026-106145
Privilege Escalation in Telerik Report Server Service-Agent Hub
PS
Patch status unknownEPSS %0
7.3
CVE-2026-106164
Infinite Loop in Telerik Document Processing XLS Import
PS
Patch status unknownEPSS %0
9.6
CVE-2026-91140
OS command injection in Progress Software Autonomous REST Connector GenAI Agents
PS
Patch verifiedEPSS %2
8.8
CVE-2026-92931
CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK
PS
Patch status unknownEPSS %0
7.9
CVE-2026-77805
Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic
PS
Patch status unknownEPSS %0
6.6
CVE-2026-77804
Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic
PS
Patch status unknownEPSS %0
3.6
CVE-2026-77803
Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic
PS
Patch status unknownEPSS %0