Threats affecting pkg:generic/net-snmp

A memory corruption vulnerability exists in the Autofill component of Google Chrome versions prior to 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by crafting a malicious HTML page. The vulnerability is classified with high severity by Chromium security.

An integer overflow vulnerability in the editing component of Google Chrome versions prior to 156.0.8078.79 could allow a remote attacker to execute arbitrary code within the browser's sandbox by delivering a crafted HTML page. The issue is classified with high security severity by Chromium.

A vulnerability in Xcode related to improper handling of symbolic links could allow an app to read arbitrary files. This issue is fixed in Xcode version 27.2 by improving symlink handling.

A heap-based buffer overflow vulnerability exists in Ghostscript when processing specially crafted TrueType fonts or documents embedding them. This flaw arises from an accounting error during font rendering that bypasses buffer size checks. Exploitation requires local access with high privileges and user interaction, potentially leading to denial of service or arbitrary code execution.

An authorization issue in Xcode was addressed by improving state management. The vulnerability could allow an app to access sensitive user data. This issue is fixed in Xcode version 27.2.

An improper input validation vulnerability exists in the Skia component of Google Chrome versions prior to 156.0.8078.79. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A vulnerability in Keycloak's required action provider mechanism allows bypassing mandatory user actions such as profile verification or terms acceptance. When an authorization request includes the kc_action query parameter set to an already assigned mandatory action, Keycloak may incorrectly skip these challenges and issue an authorization code. This flaw requires valid user credentials and affects only specific mandatory actions.

A vulnerability in the UMA resource registration endpoint of the keycloak-services component allows an authenticated user with specific permissions to update resources they do not own when remote resource management is enabled. This flaw is due to a missing ownership check when an existing resource ID is provided, enabling unauthorized modification of resource configurations such as names, URIs, and scopes.

A use-after-free vulnerability exists in the Frames component of Google Chrome versions prior to 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A vulnerability in Drupal Block AJAX allows improper modification of dynamically-determined object attributes, leading to object injection. This affects versions from 0.0.0 up to but not including 3.0.2. The issue is fixed in version 3.0.2.

A vulnerability has been identified in the Drupal ECA Helper module. The issue affects all versions of the ECA Helper module. No further technical details, impact, or remediation information are provided.

CVE-2026-107251 is an incorrect authorization vulnerability in the Drupal Entity Reference Manager (Merge entities) module. It allows forceful browsing due to improper access control. Versions from 0.0.0 up to but not including 1.0.3 are affected. The issue is fixed in version 1.0.3.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal MathJax: LaTeX module affecting versions prior to 4.1.2. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue is fixed in version 4.1.2.

A vulnerability has been identified in the Drupal Orphans Media module affecting all versions. No specific technical details, impact, or remediation information are provided.

CVE-2026-107254 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows attackers to bypass authentication by exploiting an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.

CVE-2026-107257 is an incorrect authorization vulnerability in the Drupal Actstream module that allows forceful browsing. It affects Actstream versions from 0.0.0 up to but not including 2.0.1, and from 2.1.0 up to but not including 2.1.1. Fixed versions are 2.0.1 and 2.1.1.

CVE-2026-107258 is an incorrect authorization vulnerability in the Drupal Inline Entity Form Dialog module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.6. The issue has been fixed in version 1.0.6.

CVE-2026-107259 is a vulnerability in the Drupal Linked Field module that allows code injection due to improper neutralization of special elements used in a template engine. This affects Linked Field versions from 0.0.0 up to but not including 1.8.0. The issue has been fixed in version 1.8.0.

CVE-2026-107261 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows bypassing authentication by using an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.