CVE-2026-85973

HighCVSS 7.4/10Last modified Oct 15, 2026

Description

Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker could intercept or modify information transmitted through an affected connection.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 12, 2026
Last modified
Oct 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-859747.4Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnamesCVE-2026-859757.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections CVE-2026-859765.4Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query CCVE-2026-859775.3A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a clienCVE-2026-859789.8An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discCVE-2026-859798.6Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privilegeCVE-2026-85989.1An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication anCVE-2026-859816.7The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiriCVE-2026-859829.0The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search resultCVE-2026-859837.8The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the hostCVE-2026-859849.8The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_loginCVE-2026-859855.4MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the