CVE-2026-9191Critical· 9.6▾ MidnightProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108362NonePrivasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections
CVE-2026-77363High· 8.8obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults
CVE-2026-109332Low· 3.1Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface
CVE-2026-109286High· 8.1Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages
CVE-2026-108268NoneEnclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation
CVE-2026-108269NoneRemote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections