3
CVEs
1
Critical
2
High
0
KEV
1
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
2
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (11)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-80462 | Unauthenticated privilege escalation in Progress Chef Automate lets a remote actor bypass the API gateway's identity validation and reach protected Automate functionality without credentials. The flaw stems from missing authentication on a critical path (CWE-306), carries a maximum CVSS 10.0 rating with a scope change, and is documented in a Progress Critical Security Bulletin. No public exploit has been identified at time of analysis. | CRITICAL | 10.0 | 0.3% | 50 |
PoC
|
| CVE-2026-19219 | Remote code execution in Progress Telerik UI for ASP.NET AJAX (prior to v2026.3.812) is achievable by an attacker who has first obtained the application's encryption key material and uses it to forge or tamper with dialog request parameters consumed by the RadEditor file browser component. By manipulating the folder paths the file browser reads from, writes to, and uploads into, the attacker can redirect uploads to a web-accessible directory and plant a malicious ASPX webshell, achieving server-side code execution. No public exploit has been identified at time of analysis, and the prerequisite of key material compromise meaningfully constrains real-world exploitation despite the high CVSS score. | HIGH | 8.1 | 0.2% | 41 |
|
| CVE-2026-18672 | Path traversal in the RadImageEditor component of Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.3.812) allows unauthenticated remote attackers to read arbitrary files from the server by supplying crafted state values that manipulate the control's image cache lookup. The vulnerability stems from insufficient server-side validation of client-controlled input that determines which file the cache mechanism retrieves, enabling directory traversal beyond the intended image directories. No public exploit has been identified at time of analysis, but the low-complexity unauthenticated attack vector makes this a practical risk for any internet-exposed ASP.NET application using RadImageEditor. | HIGH | 7.5 | 0.4% | 38 |
|