CVE-2026-85955 is a critical vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. It allows a remote attacker with query-execution access to invoke an XQuery evaluation function without requiring the additional evaluation privilege. This improper privilege management could lead to server-side code execution with elevated permissions, posing a severe risk to confidentiality, integrity, and availability.
CVE-2026-85954 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 allow user-controlled values to be evaluated in an elevated security context via certain higher-order XQuery functions. This improper privilege management can lead to privilege escalation beyond the attacker's granted permissions.
CVE-2026-85953 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0. It involves improper limitation of a pathname to a restricted directory in privileged legacy InfoStudio modules, which insufficiently validate user-controlled file paths and user-context values. This flaw could allow unauthorized access to server files or execution under an unintended identity.
Progress Software Corporation MarkLogic Server versions 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0 on Linux contain a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker to make unauthorized requests to internal cloud services, potentially leading to unauthorized access to cloud credentials. The vulnerability is identified as CWE-918 and has a high severity score of 8.5. No known exploits are reported in the wild, and the product is not a cloud service. Patch status is not explicitly confirmed in the provided data.
Progress Software Corporation's MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 on Azure have a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker to make unauthorized requests to internal cloud services, potentially leading to unauthorized access to cloud credentials or tokens. The vulnerability has a high severity with a CVSS score of 8.5. A patch is available to remediate this issue. The affected service is cloud-hosted, and the vendor manages remediation for this environment.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw. This flaw allows a remote attacker with administrative privileges to access authentication materials of users with higher privileges. Exploitation could lead to unauthorized administrative access. The vulnerability is identified as CWE-269 (Improper Privilege Management) and has a high severity with a CVSS score of 8.4.
Progress Software Corporation's MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, may log sensitive security information in diagnostic logs under certain configurations. This could allow an attacker with access to these logs to gain unauthorized access to protected resources. The vulnerability is identified as CWE-532, involving insertion of sensitive information into log files. It has a high severity with a CVSS score of 8.1.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an XQuery injection vulnerability in a deprecated Management API package path. This flaw allows a remote attacker with manage-user-level privileges to gain persistent unauthorized administrative control. The vulnerability is classified as improper privilege management (CWE-269) and has a critical severity with a CVSS score of 9.9.
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an authorization flaw in forest-management operations. This flaw allows a remote attacker with forest-management privileges to create a persistent unauthorized administrator account, potentially gaining full administrative control of the server. The vulnerability is rated critical with a CVSS score of 9.9.
CVE-2026-9191 is a critical origin validation vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. This flaw could allow an attacker who can execute code via these paths to perform unauthorized actions or compromise authenticated sessions.
CVE-2026-106139 is a medium severity vulnerability in Progress Software Kendo UI for Vue where the default Chart tooltip renders formatted point values as raw HTML without encoding. This affects versions from 2.5.0 up to but not including 10.1.0. An attacker with low privileges who can control a string bound to the chart can inject HTML with event handlers that execute JavaScript when a user hovers over the data point, potentially compromising data confidentiality and integrity.
A cross-site scripting (XSS) vulnerability exists in Progress Software KendoReact versions 1.1.0 up to but not including 16.2.0. The default Chart tooltip renders formatted point values as raw HTML without encoding, allowing an attacker with low privileges who can influence chart-bound string values to inject HTML with event handlers. This can lead to JavaScript execution in the user's browser when hovering over the affected data point, potentially compromising data confidentiality and integrity.
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.
In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.
CVE-2026-106164 is a high-severity vulnerability in Progress Telerik Document Processing SpreadProcessing library versions from 2026.3.811 up to but not including 2026.3.1006. It involves an infinite loop triggered by importing a specially crafted corrupted XLS file, which causes the import timeout to be ignored and results in an unresponsive CPU thread leading to denial of service.
CVE-2026-91140 is a critical OS command injection vulnerability in Progress Software Autonomous REST Connector GenAI Agents version 2.0. It arises from improper neutralization of special elements in shell-based temporary-file cleanup instructions. An attacker can exploit this by supplying a crafted Swagger/OpenAPI document, leading to arbitrary command execution on a developer's machine when the generator is invoked.
CVE-2026-92931 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637. This flaw allows a remote attacker to make server-side requests to attacker-controlled hosts, which could lead to exposure of sensitive information and impact confidentiality, integrity, and availability of the affected system.
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode signature whose certificate subject name matches a broad allow list of publisher name fragments, rather than verifying that the file is the specific executable shipped with that version of the product. A local threat actor with low privileges who replaces one of these helper executables with any other validly signed binary from an allow-listed publisher can cause the substituted binary to be executed by the application, including with Administrator privileges for the tools that request elevation, resulting in privilege escalation and execution of unintended code. Successful exploitation requires the user to launch the affected external tool and to approve the elevation prompt without noticing that it refers to a different executable.
A time-of-check to time-of-use (TOCTOU) race condition exists in Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021. This vulnerability occurs during the installation of the HTTPS interception root certificate, where a temporary file is written in a user-writable location and then imported by an elevated helper application. A local low-privilege attacker can replace this temporary file before it is read by the elevated process, causing an attacker-controlled root certificate to be installed in the Local Computer Trusted Root Certification Authorities store. Exploitation requires user initiation and approval of an elevation prompt.
CVE-2026-77803 is a low-severity vulnerability in Progress® Telerik® Fiddler® Classic for Windows versions prior to 6.0.20262.10021. It involves inconsistent interpretation of HTTP requests in the proxy request forwarding component, allowing a local low-privilege user to cause a single malformed HTTP request to be split into two requests forwarded to the origin server. This can result in an additional smuggled response without requiring a vulnerable server.