Progress Software Corporation Marklogic Server
41 CVEs affecting Progress Software Corporation Marklogic Server. Latest disclosed: 2026-10-12. Critical: 12, High: 27.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85955 | Critical | 9.9 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery e… |
CVE-2026-85948 | Critical | 9.9 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package p… |
CVE-2026-85947 | Critical | 9.9 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A… |
CVE-2026-9193 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user wit… |
CVE-2026-8709 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authent… |
CVE-2026-7329 | Critical | 9.9 | 2026-08-05 | An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows… |
CVE-2026-9192 | Critical | 9.8 | 2026-08-05 | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker t… |
CVE-2026-9191 | Critical | 9.6 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain R… |
CVE-2026-85956 | Critical | 9.6 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges… |
CVE-2026-9195 | Critical | 9.3 | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authentic… |
CVE-2026-9190 | Critical | 9.1 | 2026-08-05 | An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authent… |
CVE-2026-7557 | Critical | 9.1 | 2026-08-05 | An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allow… |
CVE-2026-85954 | High | 8.6 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQue… |
CVE-2026-85953 | High | 8.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently val… |
CVE-2026-85952 | High | 8.5 | 2026-10-12 | Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability… |
CVE-2026-85951 | High | 8.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could a… |
CVE-2026-9203 | High | 8.5 | 2026-08-05 | A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to byp… |
CVE-2026-85950 | High | 8.4 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with adm… |
CVE-2026-85949 | High | 8.1 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certai… |
CVE-2026-7327 | High | 8.1 | 2026-08-05 | An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an aut… |