CVE-2026-23929 Prototype pollution leading to stored XSS

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

CVE-2026-23929

Zabbix's searchParamsToObject() function failed to filter dangerous properties like __proto__ from URL parameters, enabling prototype pollution that, combined with jQuery's unsafe element creation traversing the prototype chain, results in persistent XSS in Maps. CVSS 4.0 scores this HIGH (8.5) w...

CVE-2026-23929

Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...

PT-2026-77102

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

PT-2026-76956

Name of the Vulnerable Software and Affected Versions Maps affected versions not specified Description A prototype pollution issue exists in the searchParamsToObject function. The processing of URL parameters fails to filter dangerous properties such as proto . When combined with unsafe element...

PT-2026-77105

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

UBUNTU-CVE-2026-74360

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches. This is enforced by checkmapprogcompatibility when the map is referenc...

PT-2026-72356

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix fault in unaligned fixup Use kzalloc obj / kzalloc objs to allocate the memcard structs, instead of kmalloc obj / kmalloc objs to prevent access to uninitialized data. Fixes runtime error: Fault in...

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

EUVD-2026-55110

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: BPF: Freeing special fields when updating lru,percpuhash maps Since lru,percpuhash maps support BPFKPTRREF,PERCPU, missing calls to ‘bpfobjfreefields’ in ‘pcpucopyvalue’ could cause the memory referenced by BPFKPTRREF,PERCPU fiel...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server. This vulnerability, an out-of-bounds read, affects the handling of XKB X Keyboard Extension modifier maps. An attacker with access to the X11 server can exploit this by sending a malformed request, causing the server to read beyond its intended memory...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Fixed the bpfxdpstorebytes proto for read-only arguments. While making some maps in Cilium read-only from the BPF side, we noticed that the bpfxdpstorebytes proto is incorrect. In particular, the verifier threw the following...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

CVE-2026-18465 WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464 WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464

CVE-2026-18464 affects the WP MAPS PRO WordPress plugin before version 6.1.3. Affected: an AJAX action does not perform a capability check and is accessible to unauthenticated users, allowing them to trigger an operation that can recurse indefinitely, exhausting server resources and causing a Den...