Threats affecting pkg:generic/net-snmp

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

CVE-2026-114572 is an authentication bypass vulnerability in the Drupal Domain Login Restrict module affecting versions from 0.0.0 up to but not including 1.5.0. The flaw allows an attacker to bypass authentication by using an alternate path or channel. A fix is available in version 1.5.0.

CVE-2026-114555 is a stored cross-site scripting (XSS) vulnerability in the Drupal Data field module. It affects versions from 0.0.0 up to but not including 2.0.14. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and later executed in users' browsers.

CVE-2026-114554 is an Incorrect Authorization vulnerability in the Drupal AI File to Text module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.1. The issue has been fixed in version 1.0.1.

CVE-2026-114571 is an incorrect authorization vulnerability in the Drupal Rabbit Hole module that allows forceful browsing. It affects Rabbit Hole versions from 0.0.0 up to but not including 1.3.0. The issue is fixed in version 1.3.0.

A vulnerability in the Drupal Monster Menus module (versions before 9.5.6) allows improper control over modification of dynamically-determined object attributes, leading to potential object injection. This flaw is identified as CWE-915 and affects Monster Menus versions from 0.0.0 up to but not including 9.5.6. The issue has been fixed in version 9.5.6.

CVE-2026-118539 is a Missing Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41 and 3.3.13.

CVE-2026-118540 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.2.0. Fixed versions are 2.41 and 3.2.0.

CVE-2026-118541 is an incorrect authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

CVE-2026-118542 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Core affecting versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user.

CVE-2026-118544 is a vulnerability in Drupal Commerce Core that allows exposure of sensitive information through data queries, enabling forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. Fixed versions are 2.41.0 and 3.3.13.

CVE-2026-118555 is an incorrect authorization vulnerability in the Drupal Commerce License module that allows forceful browsing. This affects Commerce License versions from 0.0.0 up to but not including 3.1.1. The issue is fixed in version 3.1.1.

CVE-2026-118556 is an incorrect authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. Fixed versions are 2.16.0 and 3.0.6.

CVE-2026-118557 is an Incorrect Authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. The issue has been fixed in versions 2.16.0 and 3.0.6.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Stripe versions from 2.0.0 up to but not including 2.2.3. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 2.2.3.

CVE-2026-118559 is a vulnerability in Drupal Commerce Stripe that involves improper verification of cryptographic signatures, allowing signature spoofing. It affects Commerce Stripe versions from 0.0.0 up to but not including 1.4, and from 2.0.0 up to but not including 2.2.3. Fixed versions are 1.4 and 2.2.3.

A Cross-site Scripting (XSS) vulnerability exists in Drupal Commerce Stripe versions 2.0.0 through 2.2.2. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 2.2.3.

CVE-2026-118545 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation. Fixed versions are 1.4.11 and 1.5.2.

CVE-2026-118546 is a Cross-site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions are 1.4.11 and 1.5.2.