A stored cross-site scripting (XSS) vulnerability exists in LeapWorx Premium Addons for Elementor, affecting versions up to 4.11.110. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A critical command injection vulnerability exists in Edimax BR-6208AC firmware version 1.32. The flaw is triggered via manipulation of the tftpsIP argument in the /goform/formAutoFWupgrade endpoint. This vulnerability can be exploited remotely without authentication. The vendor no longer supports this product and has not responded to disclosure attempts. The exploit has been publicly disclosed, but no patch or fix is available.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have a vulnerability where they do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. This flaw could allow a network-positioned attacker to impersonate trusted authentication infrastructure, potentially leading to unauthorized access or modification of protected data. The vulnerability has a high severity rating with a CVSS score of 7.4.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 may transmit data to Amazon S3 using cleartext transport by default. This vulnerability allows a network-positioned attacker to intercept sensitive data or credentials sent through these connections. The issue affects the confidentiality of data in transit but does not impact integrity or availability. The CVSS score is 7.5, indicating a high severity vulnerability.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have an issue where TLS certificate hostnames are not consistently validated for certain outbound connections. This flaw could allow a network attacker to intercept or modify communications with the affected service. The vulnerability has a high severity rating with a CVSS score of 7.4.
CVE-2026-103080 is a vulnerability in VillaTheme Salevo woo-boost-sales plugin versions up to 1.3.0. It involves external control of an assumed-immutable web parameter, allowing input data manipulation. The issue does not impact confidentiality or availability but can affect data integrity. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or remediation information is currently provided.
A Missing Authorization vulnerability (CWE-862) exists in Arraytics Booktics up to version 1.0.28. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized information disclosure and modification. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity). No patch or official remediation information is currently provided.
Progress MarkLogic Server versions 12.x prior to 12.1.0 may transmit certain cluster-management communications in cleartext. This vulnerability allows a network-positioned attacker to intercept or modify sensitive information exchanged within the cluster. The issue affects confidentiality and integrity of the data transmitted over the network.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 contain deprecated OpsDirector functionality with security weaknesses. These weaknesses could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially leading to unauthorized access to protected information. The vulnerability has a high severity score of 7.5 (CVSS 3.1).
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have memory-safety defects in their JavaScript engine integration. These defects can lead to memory corruption, controlled process failure, or server instability. The vulnerability is identified as CVE-2026-85965 and has a high severity rating with a CVSS score of 8. The issue affects the confidentiality, integrity, and availability of the server. No explicit patch links were provided, but fixed versions are indicated by the version boundaries.
Progress MarkLogic Server versions 12.x prior to 12.1.0 and 11.x prior to 11.3.7 assign overly permissive operating system permissions to certain log files. This misconfiguration could allow a local user to read or modify log data. The issue affects newly created and rotated logs after the fix; existing logs retain their original permissions until manually remediated.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have insufficient restrictions on access to certain security-sensitive information. This vulnerability allows a remote authenticated attacker with limited management permissions to obtain sensitive information, potentially leading to unauthorized access to protected resources. The vulnerability has a high severity with a CVSS score of 7.7.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 contain a vulnerability where an authenticated Query Console user can supply unsafe path values to a privileged filesystem helper. This flaw could lead to disclosure of arbitrary server files. The vulnerability has a high severity with a CVSS score of 7.7. No explicit patch links are provided in the input data, and the affected versions are not explicitly listed beyond the version ranges mentioned in the description.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have an authentication validation weakness. This flaw allows an attacker to use a token that should not be accepted by the server, potentially leading to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.5. No known exploits are reported in the wild. Patch status is not explicitly provided in the input data.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 contain a vulnerability where the Query Console uses predictable CSRF tokens. This flaw allows a remote attacker to trick an authenticated user into submitting unauthorized requests, potentially executing server-side code with the user's permissions. The vulnerability has a high severity rating with a CVSS score of 7.5.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have an improper authentication vulnerability in their SAML processing. This flaw allows an unauthenticated remote attacker to cause the server to accept a SAML assertion that should be rejected, potentially leading to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.5. No specific patch links are provided in the data, and the vendor advisory status is not explicitly stated.
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 have an issue where successful authentication events are not consistently recorded in audit logs. This inconsistency could hinder detection and investigation of unauthorized access or credential misuse. The vulnerability has a high severity rating with a CVSS score of 7.5.
ZITADEL versions 3.0.0 up to but not including 4.18.0 contain a missing authentication vulnerability in the hosted Login V1 UI. The vulnerability allows unauthenticated attackers to rename any active human user, including administrators, by submitting a victim's login name and posting a new username before any authentication factor is verified. This can result in locking out legitimate users from their accounts.
ZITADEL versions 4.x before 4.19.2 and 3.x through 3.4.15 have an authentication bypass vulnerability in the SAML identity-provider intent callback. The flaw arises because the system verifies the assertion signature using the provider named in the request URL but does not ensure that the resolved user matches that provider. This allows attackers with organization-administrator permissions to register a malicious SAML provider and obtain authenticated sessions as any user linked to another SAML provider on the instance, including users in other organizations.
ZITADEL versions from 3.0.0 up to but not including 4.19.2 contain a privilege escalation vulnerability in the OIDC token exchange process. This flaw allows attackers with certain impersonator roles to bypass admin impersonation checks and impersonate administrators, including the IAM_OWNER role. The vulnerability enables signing into relying applications with elevated administrative privileges. It has a medium severity rating with a CVSS score of 5.5.