Veille CVE

Mercredi 14 octobre 2026

7 CVE

Critique 4 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Progress Software Corporation MarkLogic Server » ✕
  1. CVE-2026-85960 7.5 Élevée

    Progress Software Corporation MarkLogic Server

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.

  2. CVE-2026-85956 9.6 Critique

    Progress Software Corporation MarkLogic Server

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

  3. CVE-2026-85955 9.9 Critique

    Progress Software Corporation MarkLogic Server

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

  4. CVE-2026-85954 8.6 Élevée

    Progress Software Corporation MarkLogic Server

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.

  5. CVE-2026-85950 8.4 Élevée

    Progress Software Corporation MarkLogic Server

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.

  6. CVE-2026-85948 9.9 Critique

    Progress Software Corporation MarkLogic Server

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

  7. CVE-2026-85947 9.9 Critique

    Progress Software Corporation MarkLogic Server

    Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.