Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 6 | 7 | 12 | 6 | 27 | 58 |
| Sat, 31 Oct 2026 | 11 | 41 | 44 | 0 | 16 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
23 vulnerabilities · Vendor: Progress Software
An OS command injection vulnerability in Progress WS_FTP Server on Windows allows arbitrary command execution under certain configurations. The CVSS vector is network-reachable with low attack complexity, but it requires low privileges, so an attacker needs a valid account. The flaw is fixed in the same release as the more severe, unauthenticated CVE-2026-84295, so patching the server addresses both.
Progress Software · WS_FTP Server
A path traversal flaw in Progress WS_FTP Server on Windows allows a delegated Host Administrator to reach locations outside their authorized scope. The CNA states this could potentially enable remote code execution. The attacker needs a valid Host Administrator account, so the flaw is not exploitable without prior authentication.
Progress Software · WS_FTP Server
WS_FTP Server on Windows contains an OS command injection vulnerability in versions before 2024.0.7 and 2025.0.4. Under certain configurations, an attacker can execute arbitrary commands with elevated privileges. The CNA scores the issue as critical (CVSS 9.0); the vector indicates network access without privileges or user interaction, but with high complexity.
Progress Software · WS_FTP Server
A path traversal vulnerability (CWE-22) in Progress WS_FTP Server on Windows allows a delegated Host Administrator to access or modify files outside their authorized scope. The attacker needs an existing Host Administrator delegation, which the CVSS vector rates as high privileges required (PR:H). Successful exploitation can affect the confidentiality, integrity and availability of files on the server.
Progress Software · WS_FTP Server
WS_FTP Server on Windows contains a missing authorization check in its administrative interface. A delegated Host Administrator can exceed their authorized scope, which may allow arbitrary command execution with elevated privileges and full compromise of the underlying server. The attacker needs a valid account with the delegated Host Administrator role, so the risk is mainly from compromised admin accounts, malicious insiders or chaining with another flaw.
Progress Software · WS_FTP Server
The flaw affects Progress Software WS_FTP Server on Windows in versions before 2024.0.6 and 2025.0.3. An unauthenticated remote attacker can access sensitive information, including administrative credentials, without user interaction. The CVSS 10.0 score reflects high impact on confidentiality, integrity and availability, with a changed scope. A compromised server could serve as a starting point for attacks on the wider network.
Progress Software · WS_FTP Server
Progress MOVEit Transfer contains an incorrect implementation of an authentication algorithm in its SFTP module (CWE-303). An attacker with network access and a valid low-privilege SFTP account could exploit it to gain unauthorized access, with high impact on confidentiality, integrity and availability. The vendor bulletin lists the same fixed versions but gives a CVSS score of 7.5, while the NVD record used here shows 8.8.
Progress Software · MOVEit Transfer
Progress MOVEit Transfer contains an insufficient session expiration flaw (CWE-613), tracked as CVE-2026-89073. The vendor describes it as a way to bypass access restrictions, and an attacker may be able to reuse sessions that should have expired. The vendor bulletin rates it CVSS 7.5 (High), and CISA's SSVC assessment reports total technical impact. The CVSS 9.8 in the submitted data could not be confirmed, so the vendor score is used here and the live NVD score should be checked.
Progress Software · MOVEit Transfer
The LDAP module of Progress MOVEit Transfer does not neutralise special characters in LDAP queries, which enables LDAP injection. Per the CVE data (CVSS 8.8, vector AV:N/AC:L/PR:L), an attacker on the network with a low-privilege account could affect confidentiality, integrity and availability. The CVE title links the flaw to certificate-based authentication, which the vendor has not confirmed in the sources reviewed.
Progress Software · MOVEit Transfer
A missing critical authentication step in the LDAP module of Progress MOVEit Transfer can allow an attacker to bypass authentication for LDAP sign-on. The CVE record lists affected versions as before 2025.1.6 and 2026.0.0 up to before 2026.0.4, and the attack vector is network-based. The CVSS score is disputed (9.8 in the CVE data, 8.1 in secondary sources), and no in-the-wild exploitation is documented in the sources reviewed. Internet-facing MOVEit servers with LDAP sign-on enabled carry the highest risk.
Progress Software · MOVEit Transfer
MOVEit Transfer versions before 2025.1.6 and from 2026.0.0 before 2026.0.4 contain an authentication bypass via an alternate path or channel (CWE-288) in the Secure Messaging component. According to the CVSS vector, a remote attacker with low privileges and no user interaction could bypass authentication and cause high impact to confidentiality, integrity and availability. Progress has not published the exact mechanism, and no exploitation in the wild or public proof of concept was reported at the time of research.
Progress Software · MOVEit Transfer
A flaw in MOVEit Transfer assigns incorrect permissions to a critical resource: a service directory is writable by local users. An attacker with a low-privileged local account can escalate privileges and gain high impact on confidentiality, integrity and availability. The attacker needs local access first, for example through another vulnerability or stolen credentials, so the flaw is not remotely exploitable on its own.
Progress Software · MOVEit Transfer
Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 do not sufficiently isolate user-supplied code run through certain REST and XDBC evaluation paths from HTTP request, response and session state. An attacker who can execute code through an affected path could perform unauthorized actions or compromise an authenticated session. The CVSS score is 9.6 (critical), but the vendor's preconditions, including whether a valid login is required, are not yet confirmed.
Progress Software · MarkLogic Server
MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 can evaluate user-controlled values passed to certain higher-order XQuery functions in an elevated security context. An authenticated attacker with some granted permissions could use this to gain privileges beyond those permissions. The CVSS vector lists no privileges required, which conflicts with the description, so at least a low-privilege account should be assumed.
Progress Software · MarkLogic Server
Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. An attacker with network access and low privileges could read server files without authorization or run actions under an unintended identity. CISA SSVC rates exploitation as none, the EPSS score is low, and no public exploit has been found.
Progress Software · MarkLogic Server
A server-side request forgery (SSRF) flaw in Linux-based MarkLogic Server allows an authenticated attacker to make the server send requests to internal cloud services. This can expose cloud credentials, and the CVSS score of 8.5 reflects a high confidentiality impact. The attacker needs a valid low-privilege account, but no user interaction is required.
Progress Software · MarkLogic Server
MarkLogic Server deployments on Microsoft Azure contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker can make the server send requests to internal cloud services, which may lead to unauthorized access to cloud credentials or tokens. The CNA rates the issue CVSS 8.5 (High); the impact is limited to Azure deployments, and the attacker needs a valid account.
Progress Software · MarkLogic Server
Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 contain an authorization flaw (CWE-269). A remote attacker who already holds administrative privileges could access authentication material of higher-privileged users and potentially gain unauthorized administrative access. The attack requires prior admin rights, so this is a privilege escalation step rather than an initial entry point. The vendor bulletin describes a different issue under this CVE ID, so the exact description must be verified before use in client reports.
Progress Software · MarkLogic Server
Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 contain an XQuery injection flaw in a deprecated Management API package path, classified by the CNA as improper privilege management (CWE-269). A remote attacker with a manage-user-level account could obtain persistent unauthorized administrative control. The attack requires valid credentials with delegated user-management rights; the vendor reports no known exploitation, and the CVSS score of 9.9 reflects the scope change and total impact.
Progress Software · MarkLogic Server
Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges can create a persistent unauthorized administrator account, which may lead to complete administrative control of the server. The attacker needs a valid account with forest-management rights; no user interaction is required.
Progress Software · MarkLogic Server
Telerik Report Server versions before 12.2.26.1007 contain a stored cross-site scripting flaw in the shared reporting engine and web report viewers. An authenticated report author can embed javascript: or vbscript: URLs in navigation actions or HTML text box links. When another user opens the report and triggers the link, attacker-controlled script runs in the viewer's origin. In multi-user deployments, this can be used to perform actions in an administrator's session and escalate privileges.
Progress Software · Telerik Report Server
The ARCGenAI-Generator GenAI agent definitions of Progress Software Autonomous REST Connector, version 2.0, contain an OS command injection flaw in their shell-based temporary-file cleanup instructions. An attacker who supplies a crafted Swagger/OpenAPI document can execute arbitrary commands on a developer's machine when a user runs the generator. Exploitation requires that the user processes the malicious document, and CISA SSVC lists exploitation as none.
Progress Software · Autonomous REST Connector GenAI Agents
The npm package @progress/sitefinity-nextjs-sdk, used by the Sitefinity Next.js Renderer, contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). A remote attacker can make the server send requests to an attacker-controlled host, which may expose sensitive information. No user privileges are required, but user interaction is needed according to the CVSS vector. Sites on the classic Sitefinity CMS front end are outside this advisory.
Progress Software · Sitefinity Next.js SDK
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
