Vulnerabilities and patches across Progress Software's edge and file-transfer product line — Kemp LoadMaster application delivery controllers, MOVEit Transfer, and other appliances whose compromise typically hands attackers a foothold at the network perimeter. Combined article + CVE feed for the Progress Software beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2017-9248/https://0daynews.com/cve/cve-2017-9248/Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.Mon, 17 Aug 2026 00:00:00 GMTProgress Softwarecriticalcvehttps://0daynews.com/cve/cve-2019-18935/https://0daynews.com/cve/cve-2019-18935/Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.Mon, 17 Aug 2026 00:00:00 GMTProgress Softwarecriticalcvehttps://0daynews.com/cve/cve-2023-40044/https://0daynews.com/cve/cve-2023-40044/Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.Mon, 17 Aug 2026 00:00:00 GMTProgress Softwarecriticalcvehttps://0daynews.com/cve/cve-2024-1212/https://0daynews.com/cve/cve-2024-1212/Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.Mon, 17 Aug 2026 00:00:00 GMTProgress Softwarecriticalcvehttps://0daynews.com/cve/cve-2024-4358/https://0daynews.com/cve/cve-2024-4358/Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.Mon, 17 Aug 2026 00:00:00 GMTProgress Softwarecriticalcvehttps://0daynews.com/cve/cve-2024-4885/https://0daynews.com/cve/cve-2024-4885/Progress WhatsUp Gold contains a path traversal vulnerability that allows an unauthenticated attacker to achieve remote code execution.Mon, 17 Aug 2026 00:00:00 GMTProgress Softwarecriticalcvehttps://0daynews.com/cve/cve-2024-6670/https://0daynews.com/cve/cve-2024-6670/Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.Mon, 17 Aug 2026 00:00:00 GMTProgress Softwarecriticalcvehttps://0daynews.com/articles/2026-08-08-kemp-loadmaster-cve-2026-8037-cisa-kev/https://0daynews.com/articles/2026-08-08-kemp-loadmaster-cve-2026-8037-cisa-kev/CISA added the critical Kemp LoadMaster command-injection flaw to its KEV catalog Friday after 792 reported exploitation attempts. If you haven't patched since June 4, that window is closed.Sat, 08 Aug 2026 21:00:00 GMTProgress Softwarearticlehttps://0daynews.com/articles/2026-07-23-moveit-cve-2023-34362-three-years-clop-data-breach/https://0daynews.com/articles/2026-07-23-moveit-cve-2023-34362-three-years-clop-data-breach/CVE-2023-34362 still scores EPSS 0.99 in July 2026, three years after Cl0p's mass-exploitation campaign. Here's what happened, what changed, and what hasn't.Thu, 23 Jul 2026 08:00:00 GMTProgress Softwarearticlehttps://0daynews.com/articles/2026-07-14-progress-sharefile-storage-zone-5-12-5-6-0-2-path-traversal-patch/https://0daynews.com/articles/2026-07-14-progress-sharefile-storage-zone-5-12-5-6-0-2-path-traversal-patch/Progress shipped ShareFile Storage Zone Controller 5.12.5 and 6.0.2 to fix a high-severity authenticated path traversal. CVE pending. Patch first, then bring the boxes back up.Tue, 14 Jul 2026 17:20:00 GMTProgress Softwarearticlehttps://0daynews.com/articles/2026-07-10-progress-sharefile-shutdown-storage-zone-moveit-echo/https://0daynews.com/articles/2026-07-10-progress-sharefile-shutdown-storage-zone-moveit-echo/Progress emailed on-prem ShareFile Storage Zone customers to shut down servers over a 'credible external threat.' No CVE, no patch — just an offline advisory.Fri, 10 Jul 2026 17:15:00 GMTProgress Softwarearticlehttps://0daynews.com/articles/2026-07-03-kemp-loadmaster-cve-2026-8037-pre-auth-rce/https://0daynews.com/articles/2026-07-03-kemp-loadmaster-cve-2026-8037-pre-auth-rce/A functional proof-of-concept for a critical pre-auth RCE in Progress Kemp LoadMaster hit the internet on June 29 and eSentire started seeing exploitation attempts the same day. Progress's fix has been available since June 4.Fri, 03 Jul 2026 13:00:00 GMTProgress Softwarearticle