Threats affecting pkg:generic/net-snmp

CVE-2026-118561 is a vulnerability in the Drupal Single Content Sync module that allows external control of file names or paths, leading to a path traversal issue. This affects versions from 0.0.0 up to but not including 1.4.19. The vulnerability has been fixed in version 1.4.19.

A deserialization of untrusted data vulnerability (CWE-502) exists in Drupal Single Content Sync versions from 0.0.0 up to but not including 1.4.19. This flaw allows object injection, which can lead to security issues. The vulnerability was fixed in version 1.4.19.

CVE-2026-118563 is a vulnerability affecting all versions of the Drupal CacheFlush module. The specific nature and impact of the vulnerability are not detailed in the available information. No CVSS score or detailed technical description is provided. There is no indication of known exploitation in the wild or available patches.

A vulnerability has been identified in the PayUmoney module for Drupal Commerce. The issue affects all versions of this module. No further technical details, impact, or exploitation information is provided.

A vulnerability has been identified in the Drupal GroupEx PRO (Daxko) integration affecting all versions. The issue is marked as critical and unsupported, but no specific technical details, impact, or exploitation information is provided.

CVE-2026-118582 is an authentication bypass vulnerability in the Drupal CAPTCHA module. It allows attackers to bypass functionality by using an alternate path or channel. The issue affects CAPTCHA versions from 0.0.0 up to but not including 1.18.0, and from 2.0.0 up to but not including 2.0.11. Fixed versions are 1.18.0 and 2.0.11.

CVE-2026-118569 is an incorrect authorization vulnerability in the Drupal Fasttoggle module that allows forceful browsing. This affects Fasttoggle versions from 0.0.0 up to but not including 4.1.1. The issue has been fixed in version 4.1.1.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Fasttoggle module affecting versions from 0.0.0 up to but not including 4.1.1. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users. The issue is fixed in version 4.1.1.

CVE-2026-118574 is a vulnerability in the Drupal S3 File System module that involves incorrect permission assignment for critical resources. This flaw affects versions from 0.0.0 up to but not including 3.12.0. It allows exploitation due to improperly configured access control security levels. The issue has been fixed in version 3.12.0.

CVE-2026-118567 is an incorrect authorization vulnerability in the Drupal Bulk Update User Roles module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.0.5. The issue has been fixed in version 1.0.5.

CVE-2026-118572 is an authentication bypass vulnerability in the Drupal OAuth Login - OAuth OIDC SSO module. It allows attackers to bypass authentication by exploiting an alternate path or channel. This affects versions from 0.0.0 up to but not including 3.1.1. The issue is fixed in version 3.1.1.

CVE-2026-118575 is a stored cross-site scripting (XSS) vulnerability in the Drupal Signature pad widget. It affects versions from 0.0.0 up to but not including 1.15.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue is fixed in version 1.15.0.

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module. This flaw allows improper neutralization of input during web page generation, potentially enabling XSS attacks. The vulnerability affects Stage File Proxy versions from 0.0.0 up to but not including 3.1.7, and from 4.0.0 up to but not including 4.0.1. Fixed versions are 3.1.7 and 4.0.1.

CVE-2026-118554 is an authentication bypass vulnerability in the Drupal OpenID Connect Client module. It allows attackers to bypass authentication by using an alternate path or channel. This affects versions from 0.0.0 up to but not including 2.3.1. The issue is fixed in version 2.3.1.

CVE-2026-118583 is an incorrect authorization vulnerability in the Drupal Field Permissions module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.6.0. The issue has been fixed in version 1.6.0.

CVE-2026-118584 is an incorrect authorization vulnerability in the Drupal Field Permissions module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.6.0. The issue has been fixed in version 1.6.0.

A missing authorization vulnerability (CWE-862) in the Drupal OAuth2 Token Manager component allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.2.0. The issue has been fixed in version 1.2.0.

CVE-2026-118568 is an insecure storage vulnerability in Drupal Content Sync (content-sync.io) that allows retrieval of embedded sensitive data. It affects versions from 0.0.0 up to but not including 3.2.2. The issue has been fixed in version 3.2.2.

CVE-2026-118571 is a vulnerability in the Drupal Media Alias Display module that involves the use of web browser cache containing sensitive information due to incorrectly configured access control security levels. This affects versions from 0.0.0 up to but not including 2.1.3, and from 3.0.0 up to but not including 3.0.3. Fixed versions are 2.1.3 and 3.0.3.

Brotli2Bitcoin is a purposely vulnerable web application exposed to the internet as a live hacking challenge with a $1,000 bitcoin bounty for achieving remote code execution (RCE). The challenge is streamed live, showing all attack attempts in real time. The scope is limited strictly to brotli2bitcoin.com, with authorized testing and rules to prevent denial of service or attacks outside the target. The first verified RCE that runs a specific command and reports the flag wins the bitcoin prize. This is a controlled security research exercise rather than an active threat or vulnerability disclosure.