Improper input validation in Cve-Search

CVE-2026-59509

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.003 (28.1th percentile) — read the EPSS interpretation.