CVE-2026-110210: Missing Authorization

Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted...

CVE-2026-93892

The IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are vulnerable to an information disclosure vulnerability (CWE-200). A remote authenticated attacker can obtain sensitive information because session tokens are exposed within the HTML response in the Admin console. To remediate th...

CVE-2026-93892 Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2026-85976

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

CVE-2026-85960

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...

CVE-2026-85964

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files...

CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-85976

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to HTTP response splitting . The root cause is insufficient input sanitization within the Query Console file-exploration endpoint , which can lead to unintended client-side response handling . No specific ...

CVE-2026-85976 HTTP response splitting in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

EUVD-2026-97573

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling...

CVE-2026-75888 Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-75888

A flaw in the OpenShift console allows an authenticated user to perform a Server-Side Request Forgery (SSRF) . By providing a specially crafted Helm chart URL that lacks proper validation, an attacker can force the console pod to fetch arbitrary URLs. This vulnerability could lead to the disclosu...

CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-75888 Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

EUVD-2026-97556

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files...

CVE-2026-85964

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to a path traversal vulnerability in the Query Console . An authenticated user can provide unsafe path values to a privileged filesystem helper , potentially leading to the disclosure of arbitrary server f...

CVE-2026-85964 Path traversal in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files...

EUVD-2026-97674

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...

CVE-2026-85960 Cross-site request forgery in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...