Threat Intelligence Database

CVE-2026-85976 is a medium severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly sanitize input to the Query Console file-exploration endpoint. This improper neutralization of CRLF sequences in HTTP headers could allow HTTP response splitting, potentially causing unintended client-side response handling.

CVE-2026-85970 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0. The vulnerability involves improper restriction of XML External Entity (XXE) processing, which is enabled by default in multiple server paths. This flaw could allow an attacker to craft malicious XML input that triggers server-side requests or discloses local files.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain a cross-site scripting (XSS) vulnerability. This vulnerability allows a remote attacker to execute scripts in the context of an authenticated user's browser session, potentially leading to unauthorized actions or disclosure of information accessible to that user. The vulnerability is identified as CWE-79 and has a CVSS 3.1 score of 6.1, indicating a medium severity level.

CVE-2026-85965 is a high-severity use-after-free vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x before 11.3.7 and 12.x before 12.1.0. The flaw exists in the JavaScript engine integration and can lead to memory corruption, controlled process failure, or server instability.

CVE-2026-85964 is a high-severity vulnerability in Progress Software Corporation's MarkLogic Server. It affects versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0. The flaw allows an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, potentially leading to disclosure of arbitrary server files. This vulnerability is classified as CWE-22, improper limitation of a pathname to a restricted directory. The CVSS 3.1 base score is 7.7, indicating a high impact on confidentiality without affecting integrity or availability.

Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 contain an improper authentication vulnerability in their SAML processing. This flaw allows an unauthenticated remote attacker to cause the server to accept a SAML assertion that should be rejected, potentially granting unauthorized access. The vulnerability has a high severity with a CVSS score of 7.5. No specific patch links are provided in the available data.

Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 have an insufficient logging vulnerability where successful authentication events are not consistently recorded in audit logs. This can hinder detection and investigation of unauthorized access or credential misuse.

Progress Software Corporation MarkLogic Server versions 11.0.0 up to but not including 11.3.7 contain an XML External Entity (XXE) vulnerability due to improper restriction of XML external entity references in its SAML parser configuration. This flaw allows processing of external DTDs or entities, potentially leading to unintended network access or information disclosure. The vulnerability has a high severity rating with a CVSS score of 7.5. No known exploits are reported in the wild. The vendor has not provided explicit patch information in the input data.

CVE-2026-85949 is a vulnerability in Progress Software Corporation's MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0. Under certain configurations, the server may log security-sensitive information in diagnostic logs. An attacker with access to these logs could leverage this information to gain unauthorized access to protected resources. The vulnerability has a high severity score of 8.1 CVSS 3.1.

CVE-2026-7326 is a cross-site request forgery (CSRF) vulnerability in the Admin UI of Progress MarkLogic Server versions before 11.3.6 and 12.0.3. It allows a remote attacker to trick an authenticated administrator into performing unintended administrative actions by visiting a malicious web page. This can lead to unauthorized changes in security configurations. The vulnerability has a high severity with a CVSS score of 7.5.