Threats affecting pkg:generic/osquery

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

A vulnerability has been identified in the Drupal Orphans Media module affecting all versions. No specific technical details, impact, or remediation information are provided.

CVE-2026-107254 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows attackers to bypass authentication by exploiting an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.

CVE-2026-107257 is an incorrect authorization vulnerability in the Drupal Actstream module that allows forceful browsing. It affects Actstream versions from 0.0.0 up to but not including 2.0.1, and from 2.1.0 up to but not including 2.1.1. Fixed versions are 2.0.1 and 2.1.1.

CVE-2026-107258 is an incorrect authorization vulnerability in the Drupal Inline Entity Form Dialog module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.6. The issue has been fixed in version 1.0.6.

CVE-2026-107259 is a vulnerability in the Drupal Linked Field module that allows code injection due to improper neutralization of special elements used in a template engine. This affects Linked Field versions from 0.0.0 up to but not including 1.8.0. The issue has been fixed in version 1.8.0.

CVE-2026-107261 is an authentication bypass vulnerability in the Drupal Authenticator Login Plus (2FA) module. It allows bypassing authentication by using an alternate path or channel. The issue affects versions from 0.0.0 up to but not including 1.0.1. A fix is available in version 1.0.1.

CVE-2026-107263 is an Incorrect Authorization vulnerability in the Drupal Gutenberg module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.15.0, and from 3.0.0 up to but not including 3.0.7. Fixed versions are 2.15.0 and 3.0.7.

CVE-2026-107264 is a vulnerability in the Drupal Inline Formatter Field module that allows code injection due to improper neutralization of special elements used in its template engine. This affects versions from 0.0.0 up to but not including 4.2.0. The issue has been fixed in version 4.2.0.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Leaflet module affecting versions from 0.0.0 up to but not including 10.4.13. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 10.4.13.

CVE-2026-107266 is a missing authorization vulnerability in the Drupal Views Share module that allows forceful browsing. This flaw affects Views Share versions from 0.0.0 up to but not including 2.0.1. The issue has been fixed in version 2.0.1.

CVE-2026-96389 is a missing authorization vulnerability in the Drupal Xray Audit module that allows forceful browsing. It affects multiple version ranges of the module prior to fixed releases. The issue is addressed in versions 1.6.3, 2.0.4, and 3.1.1.

A vulnerability in the Drupal Two Factor Authentication - TFA / Passwordless Login module allows insertion of sensitive information into sent data, enabling forceful browsing. This affects versions from 0.0.0 up to but not including 5.4.1, and from 5.5.0 up to but not including 5.5.2. Fixed versions are 5.4.1 and 5.5.2.

A missing authorization vulnerability (CWE-862) in Drupal DKAN allows unauthorized users to perform forceful browsing. This affects DKAN versions from 0.0.0 up to but not including 4.0.4, and from 4.1.0 up to but not including 4.1.5. Fixed versions are 4.0.4 and 4.1.5.

CVE-2026-107306 is a stored cross-site scripting (XSS) vulnerability in the Drupal Menu Link Attributes module. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This affects versions from 0.0.0 up to but not including 1.8.0. The issue is fixed in version 1.8.0.

CVE-2026-107307 is an Incorrect Authorization vulnerability in the Drupal SmartLinker AI module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.0.3. The issue has been fixed in version 1.0.3.

CVE-2026-107308 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Country module. It affects versions from 0.0.0 up to but not including 2.1.3, and from 2.2.0 up to but not including 2.2.1. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions 2.1.3 and 2.2.1 address this issue.

A missing authorization vulnerability (CWE-862) in the Drupal Easy Breadcrumb module allows unauthorized users to perform forceful browsing. This affects Easy Breadcrumb versions from 0.0.0 up to but not including 2.0.11. The issue is fixed in version 2.0.11.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Drupal Freelinking module affecting versions from 0.0.0 up to but not including 4.0.3. This vulnerability allows an attacker to induce the server to make HTTP requests to arbitrary domains. The issue has been fixed in version 4.0.3.

CVE-2026-107311 is a vulnerability in the Drupal Permissions by Term module that involves an improper check for unusual or exceptional conditions, leading to forceful browsing. This flaw affects versions from 0.0.0 up to but not including 3.1.41. The issue has been fixed in version 3.1.41.