Astra Linux – Vulnerability in libvirt

A flaw was discovered in the libvirt libxl driver. A malicious guest could continuously reboot itself, causing libvirtd on the host to become locked out or crash, resulting in a denial-of-service condition...

Astra Linux – Vulnerability in Linux

The fix for XSA-365 includes the initialization of pointers so that subsequent cleanup code would not use uninitialized or stale values. However, this initialization went too far and may, under certain conditions, also overwrite pointers that need to be cleaned up. The lack of cleanup would resul...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: making the apf token non-zero to fix the bug In the current async pagefault logic, when a page is ready, KVM relies on kvmarchcandequeuepagepresent to determine whether to deliver a READY event to the Guest. This...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: The existing SPTE is dropped/zapped even when creating an MMIO SPTE. When installing an emulated MMIO SPTE, do so after dropping/zapping the existing SPTE if it’s shadow-present. While the commit a54aa15c6bda3 was...

Astra Linux – Vulnerability in Linux 6.1

Improper initialization of the CPU cache memory could allow a privileged attacker with access to the hypervisor to overwrite the SEV-SNP guest memory, resulting in loss of data integrity...

Astra Linux – Vulnerability in Linux

The file arch/powerpc/kvm/book3srtas.c in the Linux kernel, as of version 5.13.5 on the PowerPC platform, allows KVM guest OS users to cause memory corruption in the host OS through rtasargs.nargs, also known as CID-f62f3c20647e...

Astra Linux – Vulnerability in Qemu

A reentrancy issue related to DMA operations led to a use-after-free error in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service...

Astra Linux – Vulnerability in Qemu

A stack-based buffer overflow was discovered in the virtio-net device of QEMU. This issue occurs when flushing the TX operation in the virtionetflushtx function, provided that the guest has enabled VIRTIONETFHASHREPORT, VIRTIOFVERSION1, and VIRTIONETFMRGRXBUF. This could allow a malicious user to...

Astra Linux – Vulnerability in Linux, Linux 5.10

A guest can force the Linux netback driver to consume a large amount of kernel memory. This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVEs. Incoming data packets for a guest in the Linux kernel’s netback driver are buffere...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Guest View of Google Chrome before version 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Linux 5.15

A flaw was discovered in KVM AMD Secure Encrypted Virtualization SEV within the Linux kernel. A KVM guest that uses SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. If an attacker manages to call the handler...

CVE-2026-74252

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

EUVD-2026-64063

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

CVE-2026-74252 Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

CVE-2026-74252 Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

CVE-2026-74252

J2Store (Joomla extension by j2commerce.com) is affected by a Stored XSS vulnerability in the guest checkout billing address fields, impacting versions 1.0.0–3.3.20, 4.0.0–4.0.20, and 4.1.0–4.1.5 . An unauthenticated attacker can exploit a filter bypass in Joomla's Input::getArray() combined with...

CVE-2026-74516

A flaw was found in KVM Kernel-based Virtual Machine. When the Advanced Virtual Interrupt Controller AVIC is inhibited while a nested guest L2 is active, KVM fails to properly update x2APIC MSR intercepts for the primary guest L1. This allows the L1 guest to read the host's APIC state, send...

CVE-2026-74517

A flaw was found in KVM Kernel-based Virtual Machine. This vulnerability occurs when the system attempts to process a delayed I/O APIC End-of-Interrupt EOI after the associated virtual CPUs vCPUs have been destroyed. This timing issue results in a Use-After-Free UAF condition, where the system...

CVE-2026-45199

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

CVE-2026-45199 GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...