Progress Hybrid Data Pipeline vulnerabilities

2 CVEs affecting Progress Hybrid Data Pipeline, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-6505, published 2025-07-29.

More from Progress.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-6505, published 2025-07-29. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine…
• CVE-2025-6504, published 2025-07-29. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.  Since XFF is a client-controlled header, it could be spoofed,…