PT-2026-77104

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

PT-2026-77103

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

PT-2026-77106

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-23929: Improperly Controlled Modification of Object Prototype Attributes

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

Remote File Inclusion vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions 1.14.2...

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions = 1.13.0...

UBUNTU-CVE-2026-74360

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...

PT-2026-72356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmu-flash maps of the mtd module where the use of kmalloc obj and kmalloc objs to allocate memcard structs allows access to uninitialized data. This leads to a...

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

EUVD-2026-55110

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

PT-2026-69413

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description These devices leave a web server enabled that was intended for debugging purposes. This configuration allows for the unauthorized...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

EUVD-2026-54879

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464 WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

CVE-2026-18464

The WP MAPS PRO WordPress plugin (versions before 6.1.3 ) is vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption (CWE-400 ). The root cause is an AJAX action accessible to unauthenticated users that lacks a proper capability check and fails to restrict the disp...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...