Progress Software · product
MarkLogic Server
41 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 41 is a mark on the map. Named now: 1 to 26, most at risk first.
- Authentication bypass in Progress MarkLogic Server ODBC App Server
- HTTP request smuggling in Progress MarkLogic Server
- Cross-site scripting in Progress MarkLogic Server Query Console
- Improper privilege management in Progress MarkLogic Server xdmp:eval-in
- Privilege escalation in Progress MarkLogic Server REST query interfaces
- Sensitive information exposure in Progress MarkLogic Server Azure deployments
- Path traversal in Progress MarkLogic Server Query Console
- Privilege escalation in Progress MarkLogic Server Hadoop integration
- Privilege escalation in Progress MarkLogic Server REST document patch operation
- SAML authentication bypass in Progress MarkLogic Server
- Improper privilege management in Progress MarkLogic Server Management API
- Improper privilege management in Progress MarkLogic Server forest operations
- Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector
- Improper XML external entity restriction in Progress MarkLogic Server SAML processing
- Insufficient authentication logging in Progress MarkLogic Server
- Improper privilege management in Progress MarkLogic Server backup and restore operations
- Privilege escalation in Progress MarkLogic Server REST API document processing
- Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio
- Improper OAuth token validation in Progress MarkLogic Server
- Server-side request forgery in Progress MarkLogic Server
- Improper privilege management in Progress MarkLogic Server REST extensions
- Improper Kerberos server verification in Progress MarkLogic Server
- Sensitive information exposure in Progress MarkLogic Server trace logs
- Improper authentication in Progress MarkLogic Server SAML processing
- Exposure of sensitive information in Progress MarkLogic Server
- Insufficient isolation of user-supplied code in Progress MarkLogic Server
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.