Threats affecting pkg:generic/net-snmp

A vulnerability in Drupal Block AJAX allows improper modification of dynamically-determined object attributes, leading to object injection. This affects versions from 0.0.0 up to but not including 3.0.2. The issue is fixed in version 3.0.2.

A vulnerability has been identified in the Drupal ECA Helper module. The issue affects all versions of the ECA Helper module. No further technical details, impact, or remediation information are provided.

CVE-2026-107251 is an incorrect authorization vulnerability in the Drupal Entity Reference Manager (Merge entities) module. It allows forceful browsing due to improper access control. Versions from 0.0.0 up to but not including 1.0.3 are affected. The issue is fixed in version 1.0.3.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal MathJax: LaTeX module affecting versions prior to 4.1.2. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue is fixed in version 4.1.2.

A vulnerability has been identified in the Drupal Orphans Media module affecting all versions. No specific technical details, impact, or remediation information are provided.

CVE-2026-107254 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows attackers to bypass authentication by exploiting an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.

CVE-2026-107257 is an incorrect authorization vulnerability in the Drupal Actstream module that allows forceful browsing. It affects Actstream versions from 0.0.0 up to but not including 2.0.1, and from 2.1.0 up to but not including 2.1.1. Fixed versions are 2.0.1 and 2.1.1.

CVE-2026-107258 is an incorrect authorization vulnerability in the Drupal Inline Entity Form Dialog module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.6. The issue has been fixed in version 1.0.6.

CVE-2026-107259 is a vulnerability in the Drupal Linked Field module that allows code injection due to improper neutralization of special elements used in a template engine. This affects Linked Field versions from 0.0.0 up to but not including 1.8.0. The issue has been fixed in version 1.8.0.

CVE-2026-107261 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows bypassing authentication by using an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.

CVE-2026-107263 is an Incorrect Authorization vulnerability in the Drupal Gutenberg module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.15.0, and from 3.0.0 up to but not including 3.0.7. Fixed versions are 2.15.0 and 3.0.7.

CVE-2026-107264 is a vulnerability in the Drupal Inline Formatter Field module that allows code injection due to improper neutralization of special elements used in its template engine. This affects versions from 0.0.0 up to but not including 4.2.0. The issue has been fixed in version 4.2.0.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Leaflet module affecting versions from 0.0.0 up to but not including 10.4.13. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 10.4.13.

CVE-2026-107266 is a missing authorization vulnerability in the Drupal Views Share module that allows forceful browsing. This flaw affects Views Share versions from 0.0.0 up to but not including 2.0.1. The issue has been fixed in version 2.0.1.

CVE-2026-96389 is a missing authorization vulnerability in the Drupal Xray Audit module that allows forceful browsing. It affects multiple version ranges of the module prior to fixed releases. The issue is addressed in versions 1.6.3, 2.0.4, and 3.1.1.

A vulnerability in the Drupal Two Factor Authentication - TFA / Passwordless Login module allows insertion of sensitive information into sent data, enabling forceful browsing. This affects versions from 0.0.0 up to but not including 5.4.1, and from 5.5.0 up to but not including 5.5.2. Fixed versions are 5.4.1 and 5.5.2.

A missing authorization vulnerability (CWE-862) in Drupal DKAN allows unauthorized users to perform forceful browsing. This affects DKAN versions from 0.0.0 up to but not including 4.0.4, and from 4.1.0 up to but not including 4.1.5. Fixed versions are 4.0.4 and 4.1.5.

CVE-2026-107306 is a stored cross-site scripting (XSS) vulnerability in the Drupal Menu Link Attributes module. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This affects versions from 0.0.0 up to but not including 1.8.0. The issue is fixed in version 1.8.0.

CVE-2026-107307 is an Incorrect Authorization vulnerability in the Drupal SmartLinker AI module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.0.3. The issue has been fixed in version 1.0.3.