CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,468
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product progress:moveit_transfer. Show all products

27 CVEs, showing 1 to 27
CVESeverityTitlePublished
CVE-2026-89077High 7.5MOVEit Transfer Identity validation flaw in SFTP authentication
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89076High 7.2MOVEit Transfer SQL injection in custom reporting
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89075High 7.3MOVEit Transfer Local Disclosure of Session Information Vulnerability
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89074High 7.5MOVEit Transfer Email MFA Bypass
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89073High 7.5MOVEit Transfer Access restriction bypass in OAuth authentication
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89072High 7.5MOVEit Transfer Authorization Flaw in Certificate Management
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89071High 7.5MOVEit Transfer LDAP injection in certificate-based authentication
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89070High 7.5MOVEit Transfer OIDC Authentication Replay Vulnerability
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89069High 8.0MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89068High 8.1MOVEit Transfer Authentication bypass in LDAP sign-on
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-89067High 8.8MOVEit Transfer Secure Messaging Authentication Bypass
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-87093High 8.8MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation
Assigned by ProgressSoftware
Oct 14, 2026
CVE-2026-15968Medium 5.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.Jul 23, 2026
CVE-2026-15967Critical 9.8Insufficient session expiration vulnerability in Progress MOVEit Transfer.Jul 23, 2026
CVE-2026-15966Critical 9.8Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer.Jul 23, 2026
CVE-2026-10697Critical 9.8Improper Authentication vulnerability in Progress MOVEit Transfer.Jul 23, 2026
CVE-2026-8801Critical 9.8Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).Jul 8, 2026
CVE-2026-8800High 8.8Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module).Jul 8, 2026
CVE-2026-8651High 7.5Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).Jul 8, 2026
CVE-2026-8650High 7.5Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module).Jul 8, 2026
CVE-2026-8649Critical 9.8Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).Jul 8, 2026
CVE-2026-11903Medium 5.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).Jul 8, 2026
CVE-2026-10699High 7.5Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules).Jul 8, 2026
CVE-2026-10698High 7.2Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules).Jul 8, 2026
CVE-2025-11235High 7.5Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, fr…Jan 7, 2026
CVE-2025-13147Medium 5.3Server-Side Request Forgery (SSRF) vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4.Nov 19, 2025
CVE-2023-34362
Known exploited
Critical 9.8In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transf…
Assigned by mitre
Jun 2, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.