Do Son CVE-2022-41223 and CVE-2022-40765 can be exploited by a remote authenticated attacker to execute arbitrary code on the system.
CISA
CVE-2023-22952 (CVSS score of 8.8) affects SugarCRM which could allow a remote authenticated attacker to execute arbitrary code on the system
The critical vulnerability tracked as CVE-2017-11357 is rated 9.8 out of 10 for severity on the CVSS scoring system, and was patched by Progress
CISA this week added 12 new actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog