Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fixed the issue where the bus gets locked during block-read operations for SMBus with a count of 0 IRQ. SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the interrupt-driven block-read state machine rejects this...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevention of certain integer underflows My static checker reports the following issue: drivers/infiniband/hw/irdma/ctrl.c:3605 irdmascceqinit Warning: Can subtract underflow for ‘info-dev-hmcfpmmisc.maxceqs’? It seem...

CVE-2026-41843

CVE-2026-41843...

EUVD-2026-64378

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnetteardown stops both rings and frees their frame buffers before calling tbxdomaindisablepaths. tbringstop zeroes the ring's descriptor base and tbnetfreebuffers...

CVE-2026-67362

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

CVE-2026-67362

J2Store (a Joomla e-commerce extension by j2commerce.com) contains an open redirect vulnerability in its cart controller . Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host. This allows an attacker to craft a link that ap...

CVE-2026-67362 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

EUVD-2026-64061

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

CVE-2026-67362 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

CVE-2026-73267

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267 Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the "spec.namespace" field. This allows the tenant to specify and delete any ManagedCluster,...

CVE-2026-73267 Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267

In Red Hat's multicluster engine, the clusterclaims-controller deletes ManagedClusters based solely on clusterclaim.spec.namespace without verifying ownership. Any tenant with standard ClusterClaim permissions can delete any cluster, including the hub's local-cluster, causing a HIGH-severity (7.7...

EUVD-2026-63800

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

CVE-2026-73267

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

PT-2026-79290

Name of the Vulnerable Software and Affected Versions multicluster engine affected versions not specified Description A flaw in the clusterclaims-controller component allows a tenant with standard permissions to create and delete ClusterClaim resources to cause a denial of service. By manipulatin...

CVE-2026-67362: URL Redirection to Untrusted Site

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

PT-2026-79437

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

CVE-2026-73267: Client-Side Enforcement of Server-Side Security

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...