Threats affecting pkg:generic/net-snmp

CVE-2026-114545 is an Incorrect Authorization vulnerability in the Drupal Fullcalendar View module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 5.2.6. The issue is fixed in version 5.2.6.

CVE-2026-114546 is a vulnerability in the Drupal Media Alias Display module that involves the use of web browser cache containing sensitive information. This issue arises from incorrectly configured access control security levels, potentially exposing sensitive data through browser caching. The vulnerability affects Media Alias Display versions from 0.0.0 up to but not including 2.1.2, and from 3.0.0 up to but not including 3.0.2. Fixed versions are 2.1.2 and 3.0.2.

A missing authorization vulnerability (CWE-862) in the Drupal TinyPNG module versions prior to 2.0.2 allows unauthorized users to perform forceful browsing. This could enable access to resources or functionality without proper permission checks. The issue is fixed in version 2.0.2.

A vulnerability in Drupal's ImageAPI Optimize WebP module allows sensitive information to be stored in the web browser cache due to incorrectly configured access control security levels. This affects versions from 0.0.0 up to but not including 2.1.2. The issue is addressed in version 2.1.2.

CVE-2026-107256 is a vulnerability in the Drupal Shield module that allows brute force attacks due to improper restriction of excessive authentication attempts. This affects Shield versions from 0.0.0 up to but not including 1.9.0. The issue is fixed in version 1.9.0.

CVE-2026-114572 is an authentication bypass vulnerability in the Drupal Domain Login Restrict module affecting versions from 0.0.0 up to but not including 1.5.0. The flaw allows an attacker to bypass authentication by using an alternate path or channel. A fix is available in version 1.5.0.

CVE-2026-114555 is a stored cross-site scripting (XSS) vulnerability in the Drupal Data field module. It affects versions from 0.0.0 up to but not including 2.0.14. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and later executed in users' browsers.

CVE-2026-114554 is an Incorrect Authorization vulnerability in the Drupal AI File to Text module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.1. The issue has been fixed in version 1.0.1.

CVE-2026-114571 is an incorrect authorization vulnerability in the Drupal Rabbit Hole module that allows forceful browsing. It affects Rabbit Hole versions from 0.0.0 up to but not including 1.3.0. The issue is fixed in version 1.3.0.

A vulnerability in the Drupal Monster Menus module (versions before 9.5.6) allows improper control over modification of dynamically-determined object attributes, leading to potential object injection. This flaw is identified as CWE-915 and affects Monster Menus versions from 0.0.0 up to but not including 9.5.6. The issue has been fixed in version 9.5.6.

CVE-2026-118539 is a Missing Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41 and 3.3.13.

CVE-2026-118540 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.2.0. Fixed versions are 2.41 and 3.2.0.

CVE-2026-118541 is an incorrect authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

CVE-2026-118542 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Core affecting versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user.

CVE-2026-118544 is a vulnerability in Drupal Commerce Core that allows exposure of sensitive information through data queries, enabling forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. Fixed versions are 2.41.0 and 3.3.13.

CVE-2026-118555 is an incorrect authorization vulnerability in the Drupal Commerce License module that allows forceful browsing. This affects Commerce License versions from 0.0.0 up to but not including 3.1.1. The issue is fixed in version 3.1.1.

CVE-2026-118556 is an incorrect authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. Fixed versions are 2.16.0 and 3.0.6.

CVE-2026-118557 is an Incorrect Authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. The issue has been fixed in versions 2.16.0 and 3.0.6.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Stripe versions from 2.0.0 up to but not including 2.2.3. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 2.2.3.