Threats affecting pkg:generic/net-snmp

CVE-2026-114531 is a stored cross-site scripting (XSS) vulnerability in the Drupal Swiper formatter module. It affects versions from 0.0.0 up to but not including 2.1.2, and from 3.0.1 up to but not including 3.1.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and executed in users' browsers.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

CVE-2026-114532 is a Cross-Site Scripting (XSS) vulnerability in the Drupal UI Icons component. It affects UI Icons versions from 0.0.0 up to but not including 1.1.3, and from 2.0.0 up to but not including 2.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing injection of malicious scripts. Fixed versions 1.1.3 and 2.0.2 address this issue.

A missing authorization vulnerability (CWE-862) in the Drupal Ágora Transparency Theme versions from 0.0.0 up to but not including 1.2.3 allows forceful browsing. This means unauthorized users may access restricted resources or pages. The issue is fixed in version 1.2.3.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Block Attributes module affecting versions from 0.0.0 up to but not including 2.1.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 2.1.0.

CVE-2026-114535 is a missing authorization vulnerability in the Drupal Swiper formatter module that allows forceful browsing. The issue affects versions from 0.0.0 up to but not including 2.1.2, and from 3.0.1 up to but not including 3.1.0. Fixed versions are 2.1.2 and 3.1.0.

A stored cross-site scripting (XSS) vulnerability exists in Drupal USWDS Paragraph Components affecting versions from 0.0.0 up to but not including 3.1.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 3.1.3.

CVE-2026-114537 is an incorrect authorization vulnerability in the Drupal View Unpublished module that allows forceful browsing. Versions from 0.0.0 up to but not including 1.5.0 are affected. The issue has been fixed in version 1.5.0.

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Bootstrap theme affecting versions from 0.0.0 up to but not including 3.45.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 3.45.0.

CVE-2026-114539 is an authentication bypass vulnerability in Drupal DocCheck Basic versions 7.x. It allows bypassing authentication by exploiting an alternate path or channel. This vulnerability affects all versions from 7.0.0 up to but not including 8.0.0. No CVSS score or public exploit code is currently available, and no known exploits are reported in the wild.

CVE-2026-114540 is an incorrect authorization vulnerability in the Drupal Domain module versions 3.0.0 through 3.0.1. It allows unauthorized users to perform forceful browsing, potentially accessing restricted resources. The issue is fixed in version 3.0.2.

CVE-2026-114543 is an Incorrect Authorization vulnerability in the Drupal Simple User Management module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.11.0. The issue has been fixed in version 1.11.0.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Frontend Editing versions from 0.0.0 up to but not including 1.9.3. This flaw allows unauthorized commands to be transmitted from a user that the web application trusts. The issue is fixed in version 1.9.3.

CVE-2026-114553 is an Incorrect Authorization vulnerability in the Drupal Frontend Editing module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.9.3. The issue has been fixed in version 1.9.3.

A vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect versions 6.1.0 through 6.1.2 allows sensitive information to be stored in the web browser cache due to incorrectly configured access control security levels. This issue was fixed in version 6.1.3.

CVE-2026-114544 is an Incorrect Authorization vulnerability in the Drupal Media Bulk Upload module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 3.0.6. The issue has been fixed in version 3.0.6.

CVE-2026-114545 is an Incorrect Authorization vulnerability in the Drupal Fullcalendar View module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 5.2.6. The issue is fixed in version 5.2.6.

CVE-2026-114546 is a vulnerability in the Drupal Media Alias Display module that involves the use of web browser cache containing sensitive information. This issue arises from incorrectly configured access control security levels, potentially exposing sensitive data through browser caching. The vulnerability affects Media Alias Display versions from 0.0.0 up to but not including 2.1.2, and from 3.0.0 up to but not including 3.0.2. Fixed versions are 2.1.2 and 3.0.2.

A missing authorization vulnerability (CWE-862) in the Drupal TinyPNG module versions prior to 2.0.2 allows unauthorized users to perform forceful browsing. This could enable access to resources or functionality without proper permission checks. The issue is fixed in version 2.0.2.

A vulnerability in Drupal's ImageAPI Optimize WebP module allows sensitive information to be stored in the web browser cache due to incorrectly configured access control security levels. This affects versions from 0.0.0 up to but not including 2.1.2. The issue is addressed in version 2.1.2.