Threat database

CVE-2026-77802 is a medium severity vulnerability in Progress® Telerik® Fiddler® Classic for Windows prior to version 6.0.20262.10021. It involves HTTP request smuggling due to inconsistent handling of multiple conflicting Content-Length headers in the proxy request forwarding component. A local attacker with low privileges can exploit this to smuggle additional requests against non-RFC-9110-compliant origin servers that keep connections alive. This can lead to response poisoning and unauthorized access to responses intended for other users.

CVE-2026-86158 is a high-severity vulnerability in Progress Software's Telerik Fiddler Everywhere version 1.0.0 up to but not including 8.2.0. It involves missing authentication in the local .NET backend component (Fiddler.WebUi), allowing a local unauthenticated attacker to mint OAuth tokens and access the machine-in-the-middle root certificate via unauthenticated localhost HTTP and SignalR RPC channels.

CVE-2026-86157 is a vulnerability in Progress Telerik Fiddler Everywhere before version 8.2.0 that exposes privileged inter-process communication (IPC) functionality. A local attacker with low privileges who can alter application launch parameters and convince a user to start the application may replace the UI or settings with attacker-controlled content. This can lead to disclosure of OAuth tokens, execution of local programs, or unauthorized changes to configuration files.

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.

CVE-2026-9203 is a server-side request forgery (SSRF) vulnerability in Progress Software Corporation's MarkLogic Server. It affects versions 11.0.0 and 12.0.0. The flaw allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Exploiting this vulnerability can lead to disclosure of cloud credentials and compromise of cloud resources accessible to the affected host. The vulnerability has a high severity with a CVSS score of 8.5. No official patch or remediation guidance has been provided yet.

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

CVE-2026-9193 is a critical improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server. It affects versions 11.0.0 and 12.0.0, allowing an authenticated user with a low-privileged Hadoop role to escalate privileges and perform privileged operations on the Security database. The vulnerability has a CVSS score of 9.9, indicating a severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-9192 is a critical authentication bypass vulnerability in the ODBC App Server component of Progress Software Corporation's MarkLogic Server. It affects versions 11.0.0 and 12.0.0. This flaw allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user, including administrators.

CVE-2026-9190 is an HTTP request smuggling vulnerability in the HTTP App Server component of Progress MarkLogic Server versions 11.0.0 and 12.0.0. This flaw allows a remote attacker to bypass authentication and authorization controls, hijack user sessions, or capture credentials by exploiting inconsistent interpretation of HTTP request boundaries between a reverse proxy and the server when both Content-Length and Transfer-Encoding headers are present in a crafted request.

CVE-2026-8709 is a critical improper privilege management vulnerability in Progress Software Corporation's MarkLogic Server. It affects the REST API document patch operation in versions 11.0.0 and 12.0.0, allowing an authenticated user with a low-privileged REST role to escalate privileges and perform privileged operations on the Security database. The vulnerability has a CVSS score of 9.9, indicating a severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-7557 is a critical vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.0.0 and 12.0.0. It involves improper verification of cryptographic signatures in the SAML authentication module, allowing unauthenticated remote attackers to bypass authentication and impersonate any user, including administrators. This vulnerability only affects deployments with SAML single sign-on enabled.

CVE-2026-7329 is a critical improper privilege management vulnerability in Progress Software Corporation's MarkLogic Server. It affects the SQL, SPARQL, and Optic REST query interfaces in versions 11.0.0 and 12.0.0. An authenticated user with a low-privileged REST role can escalate privileges to administrator, enabling execution of privileged operations and unauthorized data access.

CVE-2026-7327 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.0.0 and 12.0.0. It involves improper privilege management in the REST API document processing pipeline, allowing an authenticated user with an administrative REST role to escalate privileges. This escalation can lead to unauthorized disclosure of sensitive server-side data accessible by higher-privileged users.