Threats affecting pkg:bitnami/couchdb

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Block Attributes module affecting versions from 0.0.0 up to but not including 2.1.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 2.1.0.

CVE-2026-114535 is a missing authorization vulnerability in the Drupal Swiper formatter module that allows forceful browsing. The issue affects versions from 0.0.0 up to but not including 2.1.2, and from 3.0.1 up to but not including 3.1.0. Fixed versions are 2.1.2 and 3.1.0.

A stored cross-site scripting (XSS) vulnerability exists in Drupal USWDS Paragraph Components affecting versions from 0.0.0 up to but not including 3.1.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 3.1.3.

CVE-2026-114537 is an incorrect authorization vulnerability in the Drupal View Unpublished module that allows forceful browsing. Versions from 0.0.0 up to but not including 1.5.0 are affected. The issue has been fixed in version 1.5.0.

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Bootstrap theme affecting versions from 0.0.0 up to but not including 3.45.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue is fixed in version 3.45.0.

CVE-2026-114539 is an authentication bypass vulnerability in Drupal DocCheck Basic versions 7.x. It allows bypassing authentication by exploiting an alternate path or channel. This vulnerability affects all versions from 7.0.0 up to but not including 8.0.0. No CVSS score or public exploit code is currently available, and no known exploits are reported in the wild.

CVE-2026-114540 is an incorrect authorization vulnerability in the Drupal Domain module versions 3.0.0 through 3.0.1. It allows unauthorized users to perform forceful browsing, potentially accessing restricted resources. The issue is fixed in version 3.0.2.

CVE-2026-114543 is an Incorrect Authorization vulnerability in the Drupal Simple User Management module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.11.0. The issue has been fixed in version 1.11.0.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Frontend Editing versions from 0.0.0 up to but not including 1.9.3. This flaw allows unauthorized commands to be transmitted from a user that the web application trusts. The issue is fixed in version 1.9.3.

CVE-2026-114553 is an Incorrect Authorization vulnerability in the Drupal Frontend Editing module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.9.3. The issue has been fixed in version 1.9.3.

A vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect versions 6.1.0 through 6.1.2 allows sensitive information to be stored in the web browser cache due to incorrectly configured access control security levels. This issue was fixed in version 6.1.3.

CVE-2026-114544 is an Incorrect Authorization vulnerability in the Drupal Media Bulk Upload module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 3.0.6. The issue has been fixed in version 3.0.6.

CVE-2026-114545 is an Incorrect Authorization vulnerability in the Drupal Fullcalendar View module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 5.2.6. The issue is fixed in version 5.2.6.

CVE-2026-114546 is a vulnerability in the Drupal Media Alias Display module that involves the use of web browser cache containing sensitive information. This issue arises from incorrectly configured access control security levels, potentially exposing sensitive data through browser caching. The vulnerability affects Media Alias Display versions from 0.0.0 up to but not including 2.1.2, and from 3.0.0 up to but not including 3.0.2. Fixed versions are 2.1.2 and 3.0.2.

A missing authorization vulnerability (CWE-862) in the Drupal TinyPNG module versions prior to 2.0.2 allows unauthorized users to perform forceful browsing. This could enable access to resources or functionality without proper permission checks. The issue is fixed in version 2.0.2.

A vulnerability in Drupal's ImageAPI Optimize WebP module allows sensitive information to be stored in the web browser cache due to incorrectly configured access control security levels. This affects versions from 0.0.0 up to but not including 2.1.2. The issue is addressed in version 2.1.2.

CVE-2026-107256 is a vulnerability in the Drupal Shield module that allows brute force attacks due to improper restriction of excessive authentication attempts. This affects Shield versions from 0.0.0 up to but not including 1.9.0. The issue is fixed in version 1.9.0.

CVE-2026-114572 is an authentication bypass vulnerability in the Drupal Domain Login Restrict module affecting versions from 0.0.0 up to but not including 1.5.0. The flaw allows an attacker to bypass authentication by using an alternate path or channel. A fix is available in version 1.5.0.

CVE-2026-114555 is a stored cross-site scripting (XSS) vulnerability in the Drupal Data field module. It affects versions from 0.0.0 up to but not including 2.0.14. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are stored and later executed in users' browsers.

CVE-2026-114554 is an Incorrect Authorization vulnerability in the Drupal AI File to Text module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.1. The issue has been fixed in version 1.0.1.