Progress Software Corporation has 31 CVEs on record. Disclosure cadence is accelerating: 31 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 31. The median CVSS is 7.5 (high), with 5 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-269 (7) and CWE-918 (3).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 31 prev 0
31
Total CVEs
5
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-85955Critical· 9.9Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which…55CVE-2026-85948Critical· 9.9Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path55CVE-2026-85947Critical· 9.9Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations55CVE-2026-9191Critical· 9.6Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state53CVE-2026-85956Critical· 9.6Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized data…53
Progress Software Corporation vulnerabilities
CVEs affecting Progress Software Corporation, newest first. Open any entry for full detail, references, and exploit status.
31 CVEsRSS