PT-2026-76956

Name of the Vulnerable Software and Affected Versions Maps affected versions not specified Description A prototype pollution issue exists in the searchParamsToObject function. The processing of URL parameters fails to filter dangerous properties such as proto . When combined with unsafe element...

PT-2026-77103

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73375: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73367: Inclusion of Functionality from Untrusted Control Sphere

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

PT-2026-77106

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...

PT-2026-77105

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

PT-2026-77104

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73366: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73377: Missing Authorization

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-52854: Improper Neutralization of Input During Web Page Generation

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

Remote File Inclusion vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions 1.14.2...

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions = 1.13.0...

UBUNTU-CVE-2026-74360

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...

PT-2026-72356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vmu-flash maps of the mtd module where the use of kmalloc obj and kmalloc objs to allocate memcard structs allows access to uninitialized data. This leads to a...

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

EUVD-2026-55110

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...