PT-2026-110792

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description The Query Console uses predictable Cross-Site Request Forgery CSRF tokens. CSRF is a technique where an attacker tricks...

CVE-2026-9191: Origin Validation Error

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path...

CVE-2026-85955: Improper Privilege Management

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated...

Important: libX11

Issue Overview: A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the keysymmap. CVE-2026-88806 Affected Packages: libX11 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the...

CVE-2026-109309: Improper Limitation of a Pathname to a Restricted Directory

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

PT-2026-110726

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

PT-2026-110423

Name of the Vulnerable Software and Affected Versions Blinko versions prior to 1.8.9 Description An issue exists where the plugin.installPlugin tRPC procedure, accessible to any authenticated user, fails to sanitize the plugin name used to build the installation path in server/routerTrpc/plugin.t...

CVE-2026-85971: Incorrect Permission Assignment for Critical Resource

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs;...

CVE-2026-85959: Insufficient Logging

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse...

PT-2026-110642

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description Under certain configurations, the software may record security-sensitive information in diagnostic logs. An attacker wh...

PT-2026-110813

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description Insufficient sanitization of input used by the Query Console file-exploration endpoint allows for HTTP response...

PT-2026-110789

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 11.x through 11.3.6 Description The SAML parser configuration allows the processing of external DTDs Document Type Definitions or entities. This flaw could lead to unauthorized network access or the disclosur...

PT-2026-110718

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.95 Parse Server versions 9.0.0 through 9.10.2-alpha.2 Description The software fails to resolve file references that lack a URL before passing objects to LiveQuery and Cloud Code triggers. This oversight lead...

PT-2026-110720

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.93 Parse Server versions 9.0.0 through 9.10.1-alpha.12 Description Identity-scoped protectedFields including authenticated, role, or per-user groups are not enforced on count queries that utilize the $related...

Important: httpd

Issue Overview: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This...

Important: httpd

Issue Overview: Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This...

PT-2026-110872

Name of the Vulnerable Software and Affected Versions Temporal Server affected versions not specified Description In multi-cluster deployments, a connected peer cluster can modify a local namespace on a receiving cluster. This occurs because the receiving cluster applies inbound namespace...

PT-2026-110888

Name of the Vulnerable Software and Affected Versions Temporal Server affected versions not specified Description An issue exists where internal completion callbacks are not bound to the namespace that attached them. This allows an authenticated caller with write permissions in one namespace to...

CVE-2026-85967: Improper Neutralization of Input During Web Page Generation

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosu...

PT-2026-110649

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.x Description Improper privilege management allows a remote authenticated attacker with delegated database-administrator privileges to perform backup...