CVE-2026-111398 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111398 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111398

The WordPress MapSVG plugin (versions

CVE-2026-111406

The MapSVG WordPress plugin (versions

CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400: Vulnerability Analysis, Patch Management, Cyber...

CVE-2026-94230

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

CVE-2026-76740

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC...

mariadb: mariadb: Arbitrary code execution via insecure service account home directory

A flaw was found in MariaDB. The dedicated database service account was configured using the database data directory as its home directory. An authenticated database user with file-writing privileges could place malicious startup scripts into this directory. This could result in arbitrary code...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94272 Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

WordPress Snap Finance plugin 1.0.8-3.11.0 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Snap Finance versions 1.0.8-3.11.0...

CVE-2026-94272

The Snap Finance WordPress plugin versions before 3.12.0 is vulnerable to an authentication bypass. The plugin fails to verify that requests to change a WooCommerce order's status originate from an authorized source. This allows unauthenticated attackers to manipulate order states, such as moving...

EUVD-2026-104104

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

CVE-2026-94230 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

WordPress TrueBooker plugin 1.1.9-1.2.9 - Unauthenticated Booking Creation with Arbitrary Price vulnerability

Unauthenticated Booking Creation with Arbitrary Price vulnerability discovered by Amity Gilmour in WordPress Plugin TrueBooker versions 1.1.9-1.2.9...

CVE-2026-94230 TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

CVE-2026-94230

The TrueBooker WordPress plugin versions prior to 1.3.0 contains a vulnerability where certain AJAX actions lack proper authorization checks. Additionally, the application fails to perform server-side validation on the submitted service price. These flaws allow unauthenticated users to create boo...

CVE-2026-16487

Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit signature requirement; registry.redhat....