Product by Progress Software Corporation
Marklogic Server
41 known vulnerabilities in Marklogic Server (Progress Software Corporation), 0 of them actively exploited (CISA KEV).
Key figures
41
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
12
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-9192 | Authentication bypass in Progress MarkLogic Server ODBC App Server | 9.8 | |
| Critical | CVE-2026-85955 | Improper privilege management in Progress MarkLogic Server xdmp:eval-in | 9.9 | |
| Critical | CVE-2026-85948 | Improper privilege management in Progress MarkLogic Server Management API | 9.9 | |
| Critical | CVE-2026-85947 | Improper privilege management in Progress MarkLogic Server forest operations | 9.9 | |
| Critical | CVE-2026-9190 | HTTP request smuggling in Progress MarkLogic Server | 9.1 | |
| Critical | CVE-2026-9195 | Cross-site scripting in Progress MarkLogic Server Query Console | 9.3 | |
| Critical | CVE-2026-7329 | Privilege escalation in Progress MarkLogic Server REST query interfaces | 9.9 | |
| Critical | CVE-2026-85956 | Improper privilege management in Progress MarkLogic Server backup and restore operations | 9.6 | |
| Critical | CVE-2026-9193 | Privilege escalation in Progress MarkLogic Server Hadoop integration | 9.9 | |
| Critical | CVE-2026-8709 | Privilege escalation in Progress MarkLogic Server REST document patch operation | 9.9 | |
| High | CVE-2026-85964 | Path traversal in Progress MarkLogic Server Query Console | 7.7 | |
| High | CVE-2026-85961 | Sensitive information exposure in Progress MarkLogic Server Azure deployments | 7.5 | |
| Critical | CVE-2026-9191 | Insufficient isolation of user-supplied code in Progress MarkLogic Server | 9.6 | |
| Critical | CVE-2026-7557 | SAML authentication bypass in Progress MarkLogic Server | 9.1 | |
| High | CVE-2026-85953 | Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio | 8.5 | |
| High | CVE-2026-85963 | Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector | 7.5 | |
| High | CVE-2026-85950 | Improper privilege management in Progress MarkLogic Server REST extensions | 8.4 | |
| High | CVE-2026-85957 | Improper XML external entity restriction in Progress MarkLogic Server SAML processing | 7.5 | |
| High | CVE-2026-85959 | Insufficient authentication logging in Progress MarkLogic Server | 7.5 | |
| High | CVE-2026-85954 | Improper privilege management in Progress MarkLogic Server higher-order XQuery functions | 8.6 | |
| High | CVE-2026-85949 | Sensitive information exposure in Progress MarkLogic Server trace logs | 8.1 | |
| High | CVE-2026-85958 | Improper OAuth token validation in Progress MarkLogic Server | 7.5 | |
| High | CVE-2026-85952 | Server-side request forgery in Progress MarkLogic Server Linux cloud deployments | 8.5 | |
| High | CVE-2026-85951 | Server-side request forgery in Progress MarkLogic Server Azure deployments | 8.5 | |
| High | CVE-2026-85966 | Exposure of sensitive information in Progress MarkLogic Server | 7.7 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,