AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-65937

Progress Software WhatsUp Gold: cross-site scripting

Progress Software

CVE-2026-65937 · Published Aug 12, 2026 · updated Sep 2, 2026

High8.0
Fix: upgrade to 26.0.2 or later
Progress Software advisory

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

Affected versions

PackageAffectedFixed in
WhatsUp Gold
Product
< 26.0.226.0.2
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79, CWE-94

More Progress Software advisories

All Progress Software
High 7.2Aug 17Progress Software ShareFile Storage Zones Controller: remote code executionCVE-2026-16139no fix yetHigh 8.0Aug 17Progress Software ShareFile Storage Zones Controller: unsafe deserializationCVE-2026-16138no fix yetCritical 9.8Aug 12Progress Software WhatsUp Gold: remote code executionCVE-2026-65941fixed in 26.0.2Medium 4.3Aug 12Progress Software WhatsUp Gold: improper authorizationCVE-2026-65938fixed in 26.0.2Medium 6.8Aug 12Progress Software WhatsUp Gold: path traversalCVE-2026-65939fixed in 26.0.2Medium 6.8Aug 12Progress Software WhatsUp Gold: insecure default permissionsCVE-2026-65940fixed in 26.0.2