Threats affecting pkg:bitnami/couchdb

A resource allocation vulnerability exists in Drupal Examples for Developers, versions from 0.0.0 up to but not including 4.0.7. This flaw allows excessive allocation of resources due to lack of limits or throttling. The issue is fixed in version 4.0.7.

CVE-2026-107255 is an incorrect authorization vulnerability in the Drupal Restrict route by IP module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.3.1, and from 2.0.0 up to but not including 2.0.1. Fixed versions are 1.3.1 and 2.0.1.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Advanced Filesystem module affecting versions from 0.0.0 up to but not including 1.0.28. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 1.0.28.

CVE-2026-108097 is a Reflection Injection vulnerability in Drupal core caused by unsafe use of externally-controlled input to select classes or code. It affects multiple Drupal core versions from 8.9.0 up to but not including 10.6.19, 11.0.0 up to but not including 11.3.19, 11.4.0 up to but not including 11.4.10, and 12.0.0-alpha1 up to but not including 12.0.0-beta2. Fixed versions are available starting from 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2 respectively.

CVE-2026-110738 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Gin Admin Theme. It affects versions from 0.0.0 up to but not including 4.1.4, and from 5.0.0 up to but not including 5.0.16. The vulnerability arises from improper neutralization of input during web page generation. Fixed versions are 4.1.4 and 5.0.16.

A Cross-site Scripting (XSS) vulnerability exists in Drupal core affecting multiple version ranges from 8.9.0 up to but not including 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, and 12.0.0-alpha1 up to 12.0.0-beta2. The vulnerability is due to improper neutralization of input during web page generation. Fixed versions are available starting from 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal core versions from 10.3.0 up to but not including 10.6.19, 11.0.0 up to but not including 11.3.19, 11.4.0 up to but not including 11.4.10, and 12.0.0-alpha1 up to but not including 12.0.0-beta2. This vulnerability is due to improper neutralization of input during web page generation, allowing injection of malicious scripts.

CVE-2026-108099 is a Reflection Injection vulnerability in the Drupal Entity List module, caused by the use of externally-controlled input to select classes or code. This unsafe reflection issue affects versions from 0.0.0 up to but not including 3.0.10. The vulnerability allows an attacker to influence code execution paths via manipulated input. A fix is available in version 3.0.10.

CVE-2026-114523 is an OS Command Injection vulnerability in the Drupal Ffmpeg Image Toolkit. It affects versions from 0.0.0 up to but not including 1.0.3. This flaw allows improper neutralization of special elements used in OS commands, potentially enabling command injection attacks. The issue is fixed in version 1.0.3.

CVE-2026-114527 is a Cross-site Scripting (XSS) vulnerability in the Drupal UI Icons component. It affects UI Icons versions from 0.0.0 up to but not including 1.1.3, and from 2.0.0 up to but not including 2.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing injection of malicious scripts. Fixed versions are 1.1.3 and 2.0.2.

CVE-2026-114528 is a stored cross-site scripting (XSS) vulnerability in the Drupal Zero Point product. It affects versions from 0.0.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.0.1. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. Fixed versions are 1.30.0 and 2.0.1.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Black Hole module affecting versions from 0.0.0 up to but not including 1.26.0, and from 2.0.0 up to but not including 2.0.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that are stored and executed in users' browsers.

CVE-2026-114525 is a stored cross-site scripting (XSS) vulnerability in the Drupal ABC product. It affects versions from 0.0.0 up to but not including 1.25.0, and from 2.0.0 up to but not including 2.0.1. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. Fixed versions are 1.25.0 and 2.0.1.

A privilege escalation vulnerability exists in Drupal Custom Formatters due to unsafe actions defined in a privilege. This affects versions from 0.0.0 up to but not including 4.2.1. The issue is addressed in version 4.2.1.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal CSV Field module affecting versions from 0.0.0 up to but not including 2.0.10, and from 3.0.0 up to but not including 3.0.7. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts.

CVE-2026-114530 is an incorrect authorization vulnerability in the Drupal Dopup module that allows forceful browsing. This affects Dopup versions from 0.0.0 up to but not including 1.0.7. The issue has been fixed in version 1.0.7.

CVE-2026-114531 is a stored cross-site scripting (XSS) vulnerability in the Drupal Swiper formatter module. It affects versions from 0.0.0 up to but not including 2.1.2, and from 3.0.1 up to but not including 3.1.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and executed in users' browsers.

CVE-2026-107260 is a stored cross-site scripting (XSS) vulnerability in the Drupal Sector Distribution. It affects versions from 0.0.0 up to but not including 10.3.3, and from 10.4.0 up to but not including 10.4.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be stored and executed in users' browsers. Fixed versions are 10.3.3 and 10.4.2.

CVE-2026-114532 is a Cross-Site Scripting (XSS) vulnerability in the Drupal UI Icons component. It affects UI Icons versions from 0.0.0 up to but not including 1.1.3, and from 2.0.0 up to but not including 2.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing injection of malicious scripts. Fixed versions 1.1.3 and 2.0.2 address this issue.

A missing authorization vulnerability (CWE-862) in the Drupal Ágora Transparency Theme versions from 0.0.0 up to but not including 1.2.3 allows forceful browsing. This means unauthorized users may access restricted resources or pages. The issue is fixed in version 1.2.3.