Threats affecting pkg:generic/net-snmp

An authorization issue in Xcode was addressed by improving state management. The vulnerability could allow an app to access sensitive user data. This issue is fixed in Xcode version 27.2.

An improper input validation vulnerability exists in the Skia component of Google Chrome versions prior to 156.0.8078.79. This flaw could allow a remote attacker to execute arbitrary code outside the browser sandbox by delivering a crafted HTML page. The vulnerability is rated with high severity by Chromium security.

A vulnerability in Keycloak's required action provider mechanism allows bypassing mandatory user actions such as profile verification or terms acceptance. When an authorization request includes the kc_action query parameter set to an already assigned mandatory action, Keycloak may incorrectly skip these challenges and issue an authorization code. This flaw requires valid user credentials and affects only specific mandatory actions.

A vulnerability in the UMA resource registration endpoint of the keycloak-services component allows an authenticated user with specific permissions to update resources they do not own when remote resource management is enabled. This flaw is due to a missing ownership check when an existing resource ID is provided, enabling unauthorized modification of resource configurations such as names, URIs, and scopes.

A use-after-free vulnerability exists in the Frames component of Google Chrome versions prior to 156.0.8078.79. This flaw allows a remote attacker to execute arbitrary code within the sandbox by delivering a crafted HTML page. The vulnerability is classified with high severity by Chromium security.

A vulnerability in Drupal Block AJAX allows improper modification of dynamically-determined object attributes, leading to object injection. This affects versions from 0.0.0 up to but not including 3.0.2. The issue is fixed in version 3.0.2.

A vulnerability has been identified in the Drupal ECA Helper module. The issue affects all versions of the ECA Helper module. No further technical details, impact, or remediation information are provided.

CVE-2026-107251 is an incorrect authorization vulnerability in the Drupal Entity Reference Manager (Merge entities) module. It allows forceful browsing due to improper access control. Versions from 0.0.0 up to but not including 1.0.3 are affected. The issue is fixed in version 1.0.3.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal MathJax: LaTeX module affecting versions prior to 4.1.2. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue is fixed in version 4.1.2.

A vulnerability has been identified in the Drupal Orphans Media module affecting all versions. No specific technical details, impact, or remediation information are provided.

CVE-2026-107254 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows attackers to bypass authentication by exploiting an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.

CVE-2026-107257 is an incorrect authorization vulnerability in the Drupal Actstream module that allows forceful browsing. It affects Actstream versions from 0.0.0 up to but not including 2.0.1, and from 2.1.0 up to but not including 2.1.1. Fixed versions are 2.0.1 and 2.1.1.

CVE-2026-107258 is an incorrect authorization vulnerability in the Drupal Inline Entity Form Dialog module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.6. The issue has been fixed in version 1.0.6.

CVE-2026-107259 is a vulnerability in the Drupal Linked Field module that allows code injection due to improper neutralization of special elements used in a template engine. This affects Linked Field versions from 0.0.0 up to but not including 1.8.0. The issue has been fixed in version 1.8.0.

CVE-2026-107261 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows bypassing authentication by using an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.

CVE-2026-107263 is an Incorrect Authorization vulnerability in the Drupal Gutenberg module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.15.0, and from 3.0.0 up to but not including 3.0.7. Fixed versions are 2.15.0 and 3.0.7.

CVE-2026-107264 is a vulnerability in the Drupal Inline Formatter Field module that allows code injection due to improper neutralization of special elements used in its template engine. This affects versions from 0.0.0 up to but not including 4.2.0. The issue has been fixed in version 4.2.0.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Leaflet module affecting versions from 0.0.0 up to but not including 10.4.13. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 10.4.13.

CVE-2026-107266 is a missing authorization vulnerability in the Drupal Views Share module that allows forceful browsing. This flaw affects Views Share versions from 0.0.0 up to but not including 2.0.1. The issue has been fixed in version 2.0.1.