Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 407

Export CSV
CVE-2026-90867

Improper Access Control of Web Admin Console in Progress WS_FTP Server

Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-90866

Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-90865

Command Injection via FTP Notification Variables in Progress WS_FTP Server

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

CVSS 3.1 · 9 Critical EPSS 1.1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-90864

Host Administrator Path Containment Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-90863

Privilege Escalation via Missing Authorization in WS_FTP Manager

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-90862

Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-90861

Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-84296

SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server

Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-84295

Improper Authentication in Progress WS_FTP Server

Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-106159

Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler, and execute JavaScript in a user's browser when the affected button is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106160

Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106161

Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106162

Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106163

Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106149

Cross-site Scripting (XSS) in Kendo UI for jQuery Menu

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106151

Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106153

Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106147

Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106148

Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected component renders the image. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery
CVE-2026-106157

Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui Kendo Ui For Jquery