Vulnerability intelligence

CVE-2026-85956 is an improper privilege management vulnerability (CWE-269) affecting Progress MarkLogic Server versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0. The flaw allows a remote attacker who already possesses delegated database-administrator privileges to perform backup or restore operations on database forests that lie outside their authorized database scope. This occurs because the server previously authorized backup and restore requests based on the database identified in the request URL rather than validating the actual databases and forests named within the request itself. Exploiting this vulnerability can lead to unauthorized access to or modification of security-critical data. To address the issue, Progress Software released updates in MarkLogic Server versions 11.3.7 and 12.1.0, which enforce authorization checks against the actual databases and forests specified in the backup or restore requests. Organizations are advised to upgrade to these patched versions and review delegated forest and database privilege assignments.

CVE-2026-123488 is an unauthenticated SQL injection vulnerability affecting Craft CMS versions 4.0.0 before 4.18.9, as well as versions 5.0.0 before 5.11.2. The flaw is located within the platform's element search endpoint, where the `attribute` parameter is concatenated directly into a database query without sanitization. Because the application runs with emulated PDO prepared statements, this lack of input validation allows stacked SQL statements to execute. By exploiting this vulnerability, remote attackers can read and write to the database without needing prior authentication. This allows unauthorized users to modify database contents, such as overwriting password hashes or setting the administrator flag in the users table to obtain full administrative access. The vulnerability has been patched in Craft CMS versions 4.18.9 and 5.11.2.

CVE-2026-119757 is an information disclosure vulnerability affecting BTCPay Server versions prior to 2.4.2, including its 2.4.2 release candidates. The flaw allows unauthenticated remote attackers to retrieve sensitive `.macaroon` credential files associated with a Lightning Network Daemon (LND) node. These macaroon files act as cryptographic authentication tokens that grant access to the LND node's API. By obtaining these exposed credentials, an attacker can bypass standard security controls and gain administrative control over the affected LND node. This access enables unauthorized operations, such as initiating transactions, closing channels, and moving funds, which can lead to direct theft from affected deployments. To address this vulnerability, users are advised to upgrade to BTCPay Server version 2.4.2 or later and immediately rotate any potentially compromised LND macaroon credentials.

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

CVE-2024-27834 is a privilege escalation vulnerability affecting Apple Safari and other products that utilize the WebKit engine. This flaw allows an attacker who has already achieved arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC) checks. PAC is a hardware-backed security feature implemented in ARM64e architecture, designed to protect against memory corruption vulnerabilities by cryptographically signing pointers. By circumventing Pointer Authentication, this vulnerability undermines a critical security boundary that typically safeguards against code execution attacks. This means that an attacker with existing arbitrary read and write access can leverage CVE-2024-27834 to neutralize a key exploit mitigation, potentially enabling further exploitation, such as arbitrary code execution or privilege escalation on affected Apple devices. The issue was addressed by Apple with improved checks and fixed in updates including iOS 17.5, iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, and macOS Sonoma 14.5.

CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core that affects versions 4.7 through 7.1.3. The issue arises during the core update process when WordPress extracts a full-package upgrade into a predictable, web-accessible staging directory within the `wp-content/upgrade` folder. Because these temporary paths are predictable, an unauthenticated remote attacker can target the staged installer files during the brief extraction window to execute arbitrary PHP code on the underlying server. The vulnerability, discovered by researcher Umut Bayram, was patched with the release of WordPress version 7.1.4 on October 28, 2026, with security fixes backported to all affected branches. Despite the narrow timing window required to successfully exploit the race condition, security firms observed automated scanning and exploitation attempts targeting the staged installer paths almost immediately after disclosure. Due to active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026.