MapServer

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. MapServer has heap buffer overflow in SLD `Categorize` Threshold parsingCVE-2026-33721MapServer · CVSS 5.3 · 1.2% likely

   CWE-787

2. MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query TranslationCVE-2026-54354MapServer · CVSS 8.2 · 0.7% likely

   CWE-89

3. MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`CVE-2026-54355MapServer · CVSS 5.3 · 0.5% likely

   CWE-79

4. MapServer - WFS XML Filter Query SQL injectionCVE-2025-59431MapServer · CVSS 8.9 · 0.4% likely

   CWE-89

5. MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`CVE-2026-45104MapServer · CVSS 7.5 · 0.3% likely

   CWE-129

6. MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewerCVE-2026-42030MapServer · CVSS 6.1 · 0.2% likely

   CWE-80

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.