PT-2026-69415

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description These devices leave telnet servers enabled, which may allow unauthorized users to log in to the affected products via the telnet service...

CVE-2026-19074: Exposure of Sensitive Information to an Unauthorized Actor

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-66410: Improper Certificate Validation

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

PT-2026-69380

Name of the Vulnerable Software and Affected Versions Advanced Classifieds & Directory Pro versions prior to 3.4.3 Description An issue allows unauthenticated users to expose sensitive information through the AJAX action acadp public custom fields listings. This leads to the disclosure of...

PT-2026-69417

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description Improper authentication implementation in WebSocket communication allows a man-in-the-middle attack to retrieve the WebSocket private ke...

CVE-2026-66408: Use of Weak Credentials

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account...

CVE-2026-66405: Active Debug Code

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products...

CVE-2026-66411: Incorrect Implementation of Authentication Algorithm

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot...

CVE-2026-66406: Improper Certificate Validation

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege...

PT-2026-69421

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description An incorrect implementation of the authentication algorithm in Websocket communications allows an unauthenticated attacker to connect to...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

EUVD-2026-54879

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464 WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

CVE-2026-18464

The WP MAPS PRO WordPress plugin (versions before 6.1.3 ) is vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption (CWE-400 ). The root cause is an AJAX action accessible to unauthenticated users that lacks a proper capability check and fails to restrict the disp...

CVE-2026-18465

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18465 WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include...

CVE-2026-18464

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

CVE-2026-18464 WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...

EUVD-2026-54878

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts...