Threats affecting pkg:generic/net-snmp

An Incorrect Authorization vulnerability (CWE-863) exists in Drupal AI (Artificial Intelligence) allowing resource injection. This affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. Fixed versions are 1.4.11 and 1.5.2.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. This vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts.

CVE-2026-118550 is a vulnerability in Drupal AI (Artificial Intelligence) involving the use of web browser cache containing sensitive information. This issue arises from incorrectly configured access control security levels, potentially exposing sensitive data through the browser cache. It affects Drupal AI versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. Fixed versions are 1.4.11 and 1.5.2.

CVE-2026-118551 is an insecure storage vulnerability in the Drupal AI (Artificial Intelligence) module that allows retrieval of embedded sensitive data. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. Fixed versions are 1.4.11 and 1.5.2.

CVE-2026-118552 is a Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module. It affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Fixed versions 1.4.11 and 1.5.2 address this issue.

A stored cross-site scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 up to 1.4.11 and from 1.5.0 up to 1.5.2. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.

CVE-2026-118561 is a vulnerability in the Drupal Single Content Sync module that allows external control of file names or paths, leading to a path traversal issue. This affects versions from 0.0.0 up to but not including 1.4.19. The vulnerability has been fixed in version 1.4.19.

A deserialization of untrusted data vulnerability (CWE-502) exists in Drupal Single Content Sync versions from 0.0.0 up to but not including 1.4.19. This flaw allows object injection, which can lead to security issues. The vulnerability was fixed in version 1.4.19.

CVE-2026-118563 is a vulnerability affecting all versions of the Drupal CacheFlush module. The specific nature and impact of the vulnerability are not detailed in the available information. No CVSS score or detailed technical description is provided. There is no indication of known exploitation in the wild or available patches.

A vulnerability has been identified in the PayUmoney module for Drupal Commerce. The issue affects all versions of this module. No further technical details, impact, or exploitation information is provided.

A vulnerability has been identified in the Drupal GroupEx PRO (Daxko) integration affecting all versions. The issue is marked as critical and unsupported, but no specific technical details, impact, or exploitation information is provided.

CVE-2026-118582 is an authentication bypass vulnerability in the Drupal CAPTCHA module. It allows attackers to bypass functionality by using an alternate path or channel. The issue affects CAPTCHA versions from 0.0.0 up to but not including 1.18.0, and from 2.0.0 up to but not including 2.0.11. Fixed versions are 1.18.0 and 2.0.11.

CVE-2026-118569 is an incorrect authorization vulnerability in the Drupal Fasttoggle module that allows forceful browsing. This affects Fasttoggle versions from 0.0.0 up to but not including 4.1.1. The issue has been fixed in version 4.1.1.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Fasttoggle module affecting versions from 0.0.0 up to but not including 4.1.1. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users. The issue is fixed in version 4.1.1.

CVE-2026-118574 is a vulnerability in the Drupal S3 File System module that involves incorrect permission assignment for critical resources. This flaw affects versions from 0.0.0 up to but not including 3.12.0. It allows exploitation due to improperly configured access control security levels. The issue has been fixed in version 3.12.0.

CVE-2026-118567 is an incorrect authorization vulnerability in the Drupal Bulk Update User Roles module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.0.5. The issue has been fixed in version 1.0.5.

CVE-2026-118572 is an authentication bypass vulnerability in the Drupal OAuth Login - OAuth OIDC SSO module. It allows attackers to bypass authentication by exploiting an alternate path or channel. This affects versions from 0.0.0 up to but not including 3.1.1. The issue is fixed in version 3.1.1.

CVE-2026-118575 is a stored cross-site scripting (XSS) vulnerability in the Drupal Signature pad widget. It affects versions from 0.0.0 up to but not including 1.15.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue is fixed in version 1.15.0.

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module. This flaw allows improper neutralization of input during web page generation, potentially enabling XSS attacks. The vulnerability affects Stage File Proxy versions from 0.0.0 up to but not including 3.1.7, and from 4.0.0 up to but not including 4.0.1. Fixed versions are 3.1.7 and 4.0.1.

CVE-2026-118554 is an authentication bypass vulnerability in the Drupal OpenID Connect Client module. It allows attackers to bypass authentication by using an alternate path or channel. This affects versions from 0.0.0 up to but not including 2.3.1. The issue is fixed in version 2.3.1.