CVE-2026-8709

Progress MarkLogic Server contains an improper privilege management vulnerability in the REST API document patch operation. An authenticated user with a low-privileged REST role can escalate privileges and perform privileged operations against the Security database. Affected versions are before 1...

CVE-2026-7557 SAML authentication bypass in Progress MarkLogic Server

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affec...

EUVD-2026-53424

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affec...

CVE-2026-7557

An vulnerability summary for CVE-2026-7557: The SAML authentication module in Progress MarkLogic Server is affected by an improper verification of cryptographic signature. This allows an unauthenticated remote attacker to bypass authentication and impersonate any user (including administrators) i...

CVE-2026-7329 Privilege escalation in Progress MarkLogic Server REST query interfaces

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged...

EUVD-2026-53423

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged...

CVE-2026-7327

The CVE covers Progress MarkLogic Server REST API: an improper privilege management in the REST API document processing pipeline allows an authenticated user with an administrative REST role to escalate privileges, potentially exposing sensitive server-side data. Affected versions are MarkLogic S...

CVE-2026-7327 Privilege escalation in Progress MarkLogic Server REST API document processing

An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...

CVE-2026-7327

An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...

EUVD-2026-53422

An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...

EUVD-2026-53421

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

CVE-2026-7326 Cross-site request forgery in Progress MarkLogic Server Admin UI

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

CVE-2026-7326

The CVE-2026-7326 issue affects Progress MarkLogic Server Admin UI prior to versions 11.3.6 and 12.0.3. It is a cross-site request forgery (CSRF) vulnerability where an attacker lures an authenticated administrator to a malicious page to perform actions on behalf of the admin, potentially causing...

MAL-2026-13322 Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

CVE-2026-70595 Ghost: Server-Side Request Forgery Mitigation Issue

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

EUVD-2026-53388

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

CVE-2026-70595

CVE-2026-70595 affects Ghost (Node.js CMS). From version 6.26.0 through 6.54.1, an input/validation issue allowed unauthenticated users to trigger limited HTTP requests to hosts inside Ghost’s internal network (e.g., via features like Webmentions). The attack does not return response data. The vu...

CVE-2026-70595 Ghost: Server-Side Request Forgery Mitigation Issue

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

NPM: Ghost: Server-Side Request Forgery Mitigation Issue

NPM: Ghost: Server-Side Request Forgery Mitigation Issue vulnerability discovered by ? in WordPress Npm ghost versions = 6.26.0, 6.54.1...

GHSA-X5MM-WM4G-J5XV Ghost: Server-Side Request Forgery Mitigation Issue

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. Vulnerable versions This...