Improper input validation in Cve-Search

CVE-2026-59509

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search. A remote attacker can manipulate request parameters controlling the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection, enabling offline password cracking and potential administrative account compromise.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published · last modified .

EPSS exploit prediction

EPSS: 0.014 (72.1th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-59509: rose from 0.005 to 0.014.

EPSS over last 30 days · oldest: 0.005 · newest: 0.014 · change: +0.009

Affected products

Weakness classification (CWE)

References