CVE-2026-9190Critical· 9.1▾ MidnightAn HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or captu…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.7%
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-41265Critical· 9.6An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier all…
CVE-2026-118264CriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-55458LowCaddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
CVE-2026-103995Low· 2.0Lenient parsing of integers for response body and chunk framing
CVE-2026-114216Medium· 6.3Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
CVE-2026-115823NoneStarman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections