CVE-2026-111398

The WordPress MapSVG plugin (versions

CVE-2026-111398 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111398 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111406

The MapSVG WordPress plugin (versions

CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400: Vulnerability Analysis, Patch Management, Cyber...

wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash

A flaw in Wireshark's C12.22 protocol dissector allows remote attackers to trigger a Denial of Service DoS. By sending a specially crafted network packet or capture file, an attacker can crash the application, disrupting network analysis capabilities...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential OOB in getfileallinfo for compound requests When a compound request consists of QUERYDIRECTORY + QUERYINFO FILEALLINFORMATION, and the first command consumes nearly the entire maxtranssize, getfileallinfo wou...

Astra Linux – vulnerability in Apache2

The Use After Free vulnerability in the modhttp2 module of the Apache HTTP Server occurs when file handles have already been exhausted. This issue affects Apache HTTP Server versions 2.4.55 through 2.4.67...

Astra Linux – vulnerability in Imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an attacker who can connect to a magick-distribute-cache service could hijack a file descriptor in the server process when a race condition occurs. This issue h...

Astra Linux – vulnerability in Perl

IO::Compress versions prior to 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the stored expression through ev...

Astra Linux – vulnerability in tar

GNU Tar version 1.35 allows file overwriting via directory traversal in specially crafted TAR archives, following a specific two-step process. First, the victim must extract an archive containing a ../ symlink pointing to a critical directory. Second, the victim must then extract another archive...

mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

A flaw was found in MariaDB. Certain file-access User-Defined Functions UDFs within the CONNECT storage engine do not properly enforce user privileges or directory restrictions when handling file system paths. An authenticated, low-privileged database user can exploit this vulnerability to read...

CVE-2026-89286

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

CVE-2026-91047

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file...

CVE-2026-108120

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the...

mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

A flaw was found in MariaDB. Certain file-access User-Defined Functions UDFs within the CONNECT storage engine do not properly enforce user privileges or directory restrictions when handling file system paths. An authenticated, low-privileged database user can exploit this vulnerability to read...

CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

EUVD-2026-104086

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...