EUVD-2026-97603

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delet...

CVE-2026-109295 Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grepknowledgefiles or grepchatfiles with a catastrophically backtracking...

EUVD-2026-97596

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, whi...

EUVD-2026-97690

FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadowencoderinflightframes can underflow. An authenticated client can acknowled...

CVE-2026-109239

The Crawl4AI library, in versions prior to 0.9.4 , is susceptible to a blind server-side request forgery (SSRF) vulnerability within the RobotsParser.can_fetch function. This flaw allows unauthenticated attackers to bypass Docker server egress controls by enabling the check_robots_txt feature. At...

CVE-2026-109239 Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch

Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.canfetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable checkrobotstxt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata...

EUVD-2026-97682

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling linkpreviewconfig on /crawl requests. Attackers can supply a controlled page with includeexternal and includepatterns set, causing AsyncUrlSeeder to fet...

EUVD-2026-97680

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access...

CVE-2026-85958 Improper OAuth token validation in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access...

CVE-2026-85958

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected by an improper OAuth token validation weakness (CWE-287). This authentication flaw could allow an attacker to submit a token that the server should not accept, potentially leading to unauthorized access . No...

CVE-2026-85957

Progress MarkLogic Server versions 11.x prior to 11.3.7 are vulnerable to an improper XML external entity restriction within the SAML processing component. The underlying cause is a SAML parser configuration that permits the processing of external DTDs or entities . This vulnerability could lead ...

EUVD-2026-97679

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure...

react2shell-poc

React2Shell - CVE-2025-55182 PoC Proof of Concept for CVE-2025-55182 , a critical unauthenticated Remote Code Execution vulnerability in React Server Components. CVSS Score: 10.0 Critical Vulnerability The vulnerability exists in React's Flight protocol deserializer. By exploiting prototype...

EUVD-2026-97519

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or...

CVE-2026-85956 Improper privilege management in Progress MarkLogic Server backup and restore operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or...

CVE-2026-85956

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to improper privilege management during backup and restore operations. A remote attacker with delegated database-administrator privileges can perform these operations on forests outside the authorized data...

EUVD-2026-97517

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated...

CVE-2026-85955 Improper privilege management in Progress MarkLogic Server xdmp:eval-in

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated...

CVE-2026-85955

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to improper privilege management in the xdmp:eval-in function. A remote attacker with query-execution access can invoke an XQuery evaluation function without the necessary evaluation privilege, potentially...

CVE-2026-85954 Improper privilege management in Progress MarkLogic Server higher-order XQuery functions

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions...