CVE-2026-9191

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to insufficient isolation of user-supplied code. Specifically, code executed through certain REST and XDBC evaluation paths is not properly isolated from HTTP request, response, and session state . An atta...