Threats affecting pkg:generic/net-snmp

CVE-2026-118539 is a Missing Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41 and 3.3.13.

CVE-2026-118540 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.2.0. Fixed versions are 2.41 and 3.2.0.

CVE-2026-118541 is an incorrect authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

CVE-2026-118542 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Core affecting versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user.

CVE-2026-118544 is a vulnerability in Drupal Commerce Core that allows exposure of sensitive information through data queries, enabling forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. Fixed versions are 2.41.0 and 3.3.13.

CVE-2026-118555 is an incorrect authorization vulnerability in the Drupal Commerce License module that allows forceful browsing. This affects Commerce License versions from 0.0.0 up to but not including 3.1.1. The issue is fixed in version 3.1.1.

CVE-2026-118556 is an incorrect authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. Fixed versions are 2.16.0 and 3.0.6.

CVE-2026-118557 is an Incorrect Authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. The issue has been fixed in versions 2.16.0 and 3.0.6.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Stripe versions from 2.0.0 up to but not including 2.2.3. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 2.2.3.

CVE-2026-118559 is a vulnerability in Drupal Commerce Stripe that involves improper verification of cryptographic signatures, allowing signature spoofing. It affects Commerce Stripe versions from 0.0.0 up to but not including 1.4, and from 2.0.0 up to but not including 2.2.3. Fixed versions are 1.4 and 2.2.3.

A Cross-site Scripting (XSS) vulnerability exists in Drupal Commerce Stripe versions 2.0.0 through 2.2.2. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 2.2.3.

CVE-2026-118545 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation. Fixed versions are 1.4.11 and 1.5.2.

CVE-2026-118546 is a Cross-site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions are 1.4.11 and 1.5.2.

An Incorrect Authorization vulnerability (CWE-863) exists in Drupal AI (Artificial Intelligence) allowing resource injection. This affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. Fixed versions are 1.4.11 and 1.5.2.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. This vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts.

CVE-2026-118550 is a vulnerability in Drupal AI (Artificial Intelligence) involving the use of web browser cache containing sensitive information. This issue arises from incorrectly configured access control security levels, potentially exposing sensitive data through the browser cache. It affects Drupal AI versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. Fixed versions are 1.4.11 and 1.5.2.

CVE-2026-118551 is an insecure storage vulnerability in the Drupal AI (Artificial Intelligence) module that allows retrieval of embedded sensitive data. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. Fixed versions are 1.4.11 and 1.5.2.

CVE-2026-118552 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions 1.4.11 and 1.5.2 address this issue.

A stored cross-site scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 up to 1.4.11 and from 1.5.0 up to 1.5.2. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.