Threats affecting pkg:generic/net-snmp

CVE-2026-107263 is an Incorrect Authorization vulnerability in the Drupal Gutenberg module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.15.0, and from 3.0.0 up to but not including 3.0.7. Fixed versions are 2.15.0 and 3.0.7.

CVE-2026-107264 is a vulnerability in the Drupal Inline Formatter Field module that allows code injection due to improper neutralization of special elements used in its template engine. This affects versions from 0.0.0 up to but not including 4.2.0. The issue has been fixed in version 4.2.0.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Leaflet module affecting versions from 0.0.0 up to but not including 10.4.13. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 10.4.13.

CVE-2026-107266 is a missing authorization vulnerability in the Drupal Views Share module that allows forceful browsing. This flaw affects Views Share versions from 0.0.0 up to but not including 2.0.1. The issue has been fixed in version 2.0.1.

CVE-2026-96389 is a missing authorization vulnerability in the Drupal Xray Audit module that allows forceful browsing. It affects multiple version ranges of the module prior to fixed releases. The issue is addressed in versions 1.6.3, 2.0.4, and 3.1.1.

A vulnerability in the Drupal Two Factor Authentication - TFA / Passwordless Login module allows insertion of sensitive information into sent data, enabling forceful browsing. This affects versions from 0.0.0 up to but not including 5.4.1, and from 5.5.0 up to but not including 5.5.2. Fixed versions are 5.4.1 and 5.5.2.

A missing authorization vulnerability (CWE-862) in Drupal DKAN allows unauthorized users to perform forceful browsing. This affects DKAN versions from 0.0.0 up to but not including 4.0.4, and from 4.1.0 up to but not including 4.1.5. Fixed versions are 4.0.4 and 4.1.5.

CVE-2026-107306 is a stored cross-site scripting (XSS) vulnerability in the Drupal Menu Link Attributes module. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This affects versions from 0.0.0 up to but not including 1.8.0. The issue is fixed in version 1.8.0.

CVE-2026-107307 is an Incorrect Authorization vulnerability in the Drupal SmartLinker AI module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.0.3. The issue has been fixed in version 1.0.3.

CVE-2026-107308 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Country module. It affects versions from 0.0.0 up to but not including 2.1.3, and from 2.2.0 up to but not including 2.2.1. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions 2.1.3 and 2.2.1 address this issue.

A missing authorization vulnerability (CWE-862) in the Drupal Easy Breadcrumb module allows unauthorized users to perform forceful browsing. This affects Easy Breadcrumb versions from 0.0.0 up to but not including 2.0.11. The issue is fixed in version 2.0.11.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal Freelinking module affecting versions from 0.0.0 up to but not including 4.0.3. This vulnerability allows an attacker to induce the server to make HTTP requests to arbitrary domains. The issue has been fixed in version 4.0.3.

CVE-2026-107311 is a vulnerability in the Drupal Permissions by Term module that involves an improper check for unusual or exceptional conditions, leading to forceful browsing. This flaw affects versions from 0.0.0 up to but not including 3.1.41. The issue has been fixed in version 3.1.41.

A resource allocation vulnerability exists in Drupal Examples for Developers, versions from 0.0.0 up to but not including 4.0.7. This flaw allows excessive allocation of resources due to lack of limits or throttling. The issue is fixed in version 4.0.7.

CVE-2026-107255 is an incorrect authorization vulnerability in the Drupal Restrict route by IP module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.3.1, and from 2.0.0 up to but not including 2.0.1. Fixed versions are 1.3.1 and 2.0.1.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Advanced Filesystem module affecting versions from 0.0.0 up to but not including 1.0.28. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 1.0.28.

CVE-2026-108097 is a Reflection Injection vulnerability in Drupal core caused by unsafe use of externally-controlled input to select classes or code. It affects multiple Drupal core versions from 8.9.0 up to but not including 10.6.19, 11.0.0 up to but not including 11.3.19, 11.4.0 up to but not including 11.4.10, and 12.0.0-alpha1 up to but not including 12.0.0-beta2. Fixed versions are available starting from 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2 respectively.

CVE-2026-110738 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Gin Admin Theme. It affects versions from 0.0.0 up to but not including 4.1.4, and from 5.0.0 up to but not including 5.0.16. The vulnerability arises from improper neutralization of input during web page generation. Fixed versions are 4.1.4 and 5.0.16.

A Cross-site Scripting (XSS) vulnerability exists in Drupal core affecting multiple version ranges from 8.9.0 up to but not including 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, and 12.0.0-alpha1 up to 12.0.0-beta2. The vulnerability is due to improper neutralization of input during web page generation. Fixed versions are available starting from 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal core versions from 10.3.0 up to but not including 10.6.19, 11.0.0 up to but not including 11.3.19, 11.4.0 up to but not including 11.4.10, and 12.0.0-alpha1 up to but not including 12.0.0-beta2. This vulnerability is due to improper neutralization of input during web page generation, allowing injection of malicious scripts.