CVE-2026-106133

Incorrect Authorization in Telerik Report Server Web Report Designer

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Telerik Report Server Telerik Report Server

CVE-2026-118975

XML External Entity (XXE) Injection in Telerik Reporting SVG Processing

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network requests, from the report rendering host. External XML entities in SVG content were resolved without applying the configured strict resource resolver and report path validation. Disclosed content is limited by the permissions of the rendering process and by what the rendered report output exposes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Telerik Reporting Telerik Reporting

CVE-2026-106152

External Control of Configuration Setting in Telerik Report Server

In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration setting vulnerability allows an unauthenticated remote attacker to influence the server address used by Report Server when generating links and notifications. With user interaction, this can lead to disclosure of sensitive information and account takeover.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Telerik Report Server Telerik Report Server

CVE-2026-106140

Deserialization of Untrusted Data in Telerik Reporting Report Designers

In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Telerik Reporting Telerik Reporting

CVE-2026-115338

Insecure XFT Transport in Progress WS_FTP Server

Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115337

Folder Permission Bypass in Progress WS_FTP Server

Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115336

FTP Quota Accounting Bypass in Progress WS_FTP Server

Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115341

Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server

Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115339

Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server

Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-115340

Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server

Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-104657

Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress Software

Products

Fiddler Download & Setup Skill

CVE-2026-65941

WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-84294

Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90872

Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90871

Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90870

Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90869

Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90868

OS Command Injection in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

CVSS 3.1 · 9.9 Critical EPSS 1.5% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90867

Improper Access Control of Web Admin Console in Progress WS_FTP Server

Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server

CVE-2026-90866

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Ws Ftp Server Ws Ftp Server