CVE-2024-6670

CVE-2024-6670 PoC для уязвимости обхода аутентификации через SQL-инъекцию HasErrors в Progress Software WhatsUp Gold CVE-2024-6670 Анализ первопричины уязвимости можно найти в моём блоге: https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/ Использование python CVE-2024-6670.py...

CVE-2026-91140

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

EUVD-2026-93397

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-91140

The Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 contains an OS command injection vulnerability (CWE-78) within its shell-based temporary-file cleanup instructions. An attacker can execute arbitrary commands on a developer's machine by providing a crafte...

PT-2026-106736

Name of the Vulnerable Software and Affected Versions Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator versions prior to 2.1 Description An OS command injection flaw exists in the shell-based temporary-file cleanup instructions. An attacker can execute arbitrary command...

CVE-2026-86158

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

EUVD-2026-88649

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-86158

Progress Software Fiddler Everywhere 8.0.2 contains a vulnerability due to missing authentication in its local .NET backend (Fiddler.WebUi ). A local unauthenticated attacker can exploit unauthenticated localhost HTTP and SignalR RPC channels to mint OAuth tokens and read the machine-in-the-middl...

CVE-2026-86158: Missing Authentication for Critical Function

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of GetFileWithoutZip method. The issue results from th...

CVE-2026-19219

creationtimestamp| type| source ---|---|--- 2026-09-02 16:15:11+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-875 2026-09-02 16:37:46+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mukenume3j25...

CVE-2026-18672

creationtimestamp| type| source ---|---|--- 2026-09-02 16:15:09+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-875 2026-09-02 16:37:03+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mukemlw3f72q...

CVE-2026-9192

Summary (CVE-2026-9192) : A authentication-bypass vulnerability exists in the ODBC App Server component of Progress MarkLogic Server, affecting versions before 11.3.6 and 12.0.3. An unauthenticated remote attacker can bypass password verification and run queries with the privileges of any named u...

CVE-2026-59689

creationtimestamp| type| source ---|---|--- 2026-07-28 20:15:10+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755 2026-07-28 20:45:12+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-7 2026-08-13...

CVE-2026-59687

creationtimestamp| type| source ---|---|--- 2026-07-28 20:15:05+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755 2026-07-28 20:45:07+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-7 2026-08-13...

CVE-2026-59686

creationtimestamp| type| source ---|---|--- 2026-07-28 20:15:02+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-755 2026-07-28 20:45:05+00:00| seen| https://www.acn.gov.it/portale/w/progress-software-aggiornamenti-di-sicurezza-7 2026-08-13...

CVE-2026-59690

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

CVE-2026-59686

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-59690: Missing Authorization

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...