cve2023-44372

cve2023-44372 Under Work Please come Back Later...

CVE-2026-112285

The Thelia e-commerce platform is affected by a business logic vulnerability in versions prior to 3.1.5 and 3.2.x before 3.2.4 . The flaw arises because coupon usage is only recorded once an order is paid. Authenticated customers can exploit this by placing multiple pay-later orders to bypass usa...

CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

Post-Quantum Session Establishment for Matter over Thread: Message Size, Transport, and Protocol Options

Matter's first post-quantum change protects device attestation with ML-DSA, but its operational handshake, CASE, still derives session keys from P-256 ECDH, so recorded traffic can be decrypted once a quantum computer exists. We quantify the cost of moving CASE to ML-KEM and post-quantum signatur...

Cost of Delay for Post-Quantum Migration: Putting Classical and Harvest-Now-Decrypt-Later Risk on One Ordered List

Organisations deciding which assets to migrate to post-quantum cryptography first, and how that work competes with a backlog of classical findings, lack a common unit: post-quantum scores are dimensionless and quantum-only, while classical risk is annualised loss. We express both threats as a cos...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The can: mcp251x device has a bug where a deadlock can occur in the error path of the mcp251xopen function. The mcp251xopen function calls freeirq in its error path, with the mpclock mutex being held. However, if an interrupt has...

CLEANSTART-2026-AI29486 Security fix for CVE-2025-47912 applied in: apache-nifi 2.10.0-r4, argo-cd 2.14.20-r0, argo-cd-fips 2.13.9-r3, argo-cd-fips 2.14.20-r0, argo-cd-fips 3.1.9-r0, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cni-plugin-flannel 1.6.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, druid-exporter-fips 0.11-r2, eck-operator-fips 3.2.0-r0, external-dns-fips 0.20.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.24 1.24.9-r0, go-fips-1.25 1.25.1-r0, harbor-registry 3.0.0.1-r2, harbor-registry-fips 3.0.0-r1, helm 3.19.0-r0, helm-fips 3.19.0-r0, helm-operator 1.41.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kubernetes 1.34.1-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kured 1.20.0-r0, kustomize-fips 5.7.1-r0, kyverno 1.15.2-r0, logstash-exporter 1.9.1-r0, metallb 0.14.9-r0, metallb 0.15.2-r0, minio-operator 7.1.1-r0, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0, stakater-reloader 1.4.8-r0, step 0.28.7-r1, step-cli 0.28.7-r1, step-issuer 0.9.9-r1, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r1, vault-k8s 1.7.0-r0, velero 1.17.0-r0, velero-plugin-for-aws 1.13.0-r0, velero-plugin-for-csi 0.7.1-r0, wave 0.10.0-r0

CVE-2025-47912 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XD72543 Security fix for GHSA-fw7p-63qq-7hpr applied in: argo-workflows 3.7.10-r3, argo-workflows 3.7.9-r1, argo-workflows 4.0.1-r0, argo-workflows-fips 3.7.10-r0, argo-workflows-fips 3.7.8-r2, argo-workflows-fips 3.7.9-r2, certificate-transparency-trillian-ctserver 1.3.2-r1, dex 2.42.1-r1, dex 2.43.1-r1, dex-fips 2.43.1-r5, gitea-fips 1.25.5-r0, grafana-alloy 1.13.2-r0, grafana-alloy-fips 1.12.1-r2, jitsucom-bulker 2.10.0-r1, keda 2.18.3-r0, keda 2.19.0-r0, kyverno-fips 1.13.6-r9, kyverno-policy-reporter-fips 3.3.3-r3, kyverno-policy-reporter-fips 3.4.2-r3, kyverno-policy-reporter-fips 3.5.0-r3, kyverno-policy-reporter-fips 3.7.2-r0, kyverno-policy-reporter-fips 3.7.4-r0, openbao 2.4.3-r1, percona-xtradb-cluster-operator-fips 1.16.1-r0, percona-xtradb-cluster-operator-fips 1.19.0-r2, prom-mysqld-exporter-fips 0.18.0-r2, rekor-backfill-index 1.4.3-r2, step-ca-fips 0.29.0-r1, step-cli 0.27.5-r0, tekton-chains-fips 0.26.0-r4, temporal-server 1.29.6-r0, temporal-server 1.30.4-r0, temporal-server-fips 1.29.6-r0, terragrunt-fips 0.94.0-r0, terragrunt-fips 0.95.1-r0, terragrunt-fips 0.96.1-r0, terragrunt-fips 0.97.2-r0, terragrunt-fips 0.98.0-r0, terragrunt-fips 0.99.3-r0, terragrunt-fips 0.99.4-r0

GHSA-fw7p-63qq-7hpr affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CO42319 Security fix for CVE-2026-27137 applied in: argo-cd 3.2.7-r1, aws-ebs-csi-driver 1.54.0-r1, aws-efs-csi-driver 2.2.0-r1, coredns 1.14.1-r1, external-dns 0.18.0-r1, git-lfs 3.7.0-r3, grafana-rollout-operator 0.35.0-r0, helm 4.0.1-r1, helm 4.1.1-r2, kafka 4.0.1-r3, kafka-fips 4.0.1-r3, kubernetes-dashboard-metrics-scraper 1.2.2-r1, kustomize 5.7.1-r3, newrelic-fluent-bit-output 2.4.0-r1, newrelic-nri-kube-events 2.16.4-r1, newrelic-prometheus-configurator 2.4.4-r1, node-problem-detector 0.8.19-r2, pmm 3.5.0-r0, prometheus-redis-exporter 1.82.0-r0, restic 0.18.0-r0, sigstore-scaffolding 0.7.31-r2, stakater-reloader 1.4.14-r0, syft 1.39.0-r2, tigera-operator 1.41.1-r0, trillian 1.7.2-r1, trust-manager 0.20.2-r1, velero 1.17.2-r2, velero-plugin-for-aws 1.13.1-r3, wave 0.11.0-r0, weaviate 1.35.2-r1, whereabouts 0.9.2-r1

CVE-2026-27137 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BH99085 Security fix for GHSA-6g7g-w4f8-9c9x applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.14.1-r0, grafana-alloy-fips 1.12.1-r2, kubevela 1.10.8-r0, opentelemetry-collector-contrib 0.144.0-r4, opentelemetry-collector-contrib-fips 0.144.0-r3, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, terragrunt-fips 0.94.0-r2, terragrunt-fips 0.95.1-r2, terragrunt-fips 0.96.1-r2, terragrunt-fips 0.97.2-r4, terragrunt-fips 0.98.0-r4, terragrunt-fips 0.99.4-r3, weaviate 1.35.2-r2

GHSA-6g7g-w4f8-9c9x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EW06968 Security fix for CVE-2026-33871 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r1, apache-nifi 2.7.2-r2, cloud-config-server 4.3.2-r3, cloudwatch-exporter 0.16.0-r1, elasticsearch 9.2.7-r0, elasticsearch 9.2.8-r0, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.6-r5, keycloak 26.6.1-r1, keycloak 26.6.1-r2, kogito-apps 10.1.0-r1, kserve-modelmesh 0.10.0-r0, kserve-modelmesh 0.12.0-r0, management-api-for-apache-cassandra-5.0 0.1.118-r2, s3proxy 3.3.0-r1, sonarqube 25.12.0.117093-r3, sonarqube 26.4.0.121862-r2, stargate 1.0.91-r0, stargate 2.0.44-r6, stargate 2.0.48-r0, strimzi-kafka-operator 0.50.1-r1, strimzi-kafka-operator 0.51.0-r1, thingsboard 4.3.0.1-r2, thingsboard 4.3.1-r1, thingsboard 4.3.1.1-r0, trino 480-r3, wavefront-proxy 13.9-r1, wildfly 39.0.1-r0

CVE-2026-33871 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LN00510 Security fix for GHSA-w8rr-5gcm-pp58 applied in: argo-workflows 4.0.4-r0, cloudprober-fips 0.13.9-r0, cloudprober-fips 0.14.2-r0, distribution 3.1.0-r0, distribution-fips 3.1.0-r0, docker 29.3.0-r1, docker-compose 5.1.0-r0, gotenberg 8.30.1-r0, grafana 12.2.10-r1, grafana-alloy 1.14.2-r2, grafana-alloy 1.15.0-r1, grafana-alloy 1.15.1-r1, grafana-alloy-fips 1.14.2.r0, grafana-alloy-fips 1.15.0-r0, grafana-mimir-fips 2.17.10-r0, grafana-mimir-fips 3.0.5-r1, grafana-mimir-fips 3.0.6-r0, grafana-rollout-operator 0.36.0-r1, keda 2.19.0-r3, keda-fips 2.18.3-r3, loki 3.6.10-r0, opentelemetry-collector-contrib 0.149.0-r0, opentofu-fips 1.10.9-r4, opentofu-fips 1.11.5-r3, opentofu-fips 1.11.6-r0, opentofu-fips 1.7.10-r4, opentofu-fips 1.8.11-r4, opentofu-fips 1.9.4-r4, prometheus 3.5.2:r0, prometheus-fips 3.11.2-r0, tekton-pipelines 1.10.2-r0, tekton-pipelines 1.11.0-r0, tekton-pipelines 1.7.0-r0, tekton-pipelines 1.9.2-r0, tekton-pipelines-fips 1.7.0-r0, tekton-pipelines-fips 1.9.2-r0, tempo 2.7.2-r2, terraform 1.15.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.97.2-r5, terragrunt-fips 0.98.0-r5, terragrunt-fips 0.99.5-r0, terragrunt-fips 1.0.1-r1, zot 2.1.13-r2

GHSA-w8rr-5gcm-pp58 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PM96717 Security fix for CVE-2026-40179 applied in: amazon-cloudwatch-agent 1.300071.0-r1, certificate-transparency-trillian-ctserver 1.3.2-r2, certificate-transparency-trillian-ctserver-fips 1.3.2-r0, cortex 1.21.0-r0, elastic-beats 8.19.15-r0, elastic-beats 9.2.8-r6, elastic-beats 9.4.0-r1, grafana 12.3.10-r1, grafana 12.4.7-r1, grafana 13.0.5-r1, grafana 13.0.7-r1, helm-operator-fips 1.41.1-r2, istio 1.27.9-r0, istio 1.29.2-r0, istio-fips 1.29.2-r0, istio-fips 1.30.0-r0, istio-pilot-discovery 1.28.3-r1, istio-pilot-discovery-fips 1.28.3-r1, keda 2.19.0-r3, keda-fips 2.18.3-r3, keda-fips 2.19.0-r2, loki 3.6.10-r1, minio-operator-fips 7.1.1-r9, pmm 3.5.0-r0, prometheus-operator 0.69.1-r1, prometheus-operator 0.87.1-r3, prometheus-pushgateway 1.10.0-r1, prometheus-pushgateway-fips 1.10.0-r3, tempo-fips 2.7.2-r0, tempo-fips 2.8.3-r0, tempo-fips 2.9.1-r0

CVE-2026-40179 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VX38000 Security fix for CVE-2026-34479 applied in: akhq 0.27.1-r5, confluent-kafka 8.2.0-r0, elasticsearch 9.2.7-r2, elasticsearch 9.2.8-r0, elasticsearch 9.2.8-r2, elasticsearch 9.3.7-r0, elasticsearch 9.4.3-r0, flink 2.0.2-r1, flink 2.1.3-r1, kafka 4.0.1-r4, kafka 4.0.2-r0, kafka 4.1.2-r0, kafka-fips 4.0.2-r1, schema-registry 8.1.2-r0, sonarqube 25.12.0.117093-r3, sonarqube 26.4.0.121862-r2, spark-sc213-jdk17-py311 4.1.1-r2

CVE-2026-34479 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QW73146 Security fix for GHSA-w573-9ffj-6ff9 applied in: apache-hive 4.2.0-r5, apache-nifi 2.10.0-r1, apache-nifi 2.9.0-r1, cassandra 5.0.8-r1, hazelcast 5.7.0-r1, kafka-ui 1.4.2-r6, keycloak 26.4.7-r3, keycloak 26.6.3-r2, kserve-modelmesh 0.12.0-r17, s3proxy 3.3.0-r2, solr 9.8.1-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

GHSA-w573-9ffj-6ff9 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QR01037 Security fix for CVE-2026-41852 applied in: activemq 5.19.8-r3, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, rundeck 6.0.0-r0

CVE-2026-41852 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DA65279 Security fix for CVE-2026-69192 applied in: langfuse-worker 3.194.1-r1, langfuse-worker 3.212.0-r1, langfuse-worker 3.213.0-r1, langfuse-worker 3.214.0-r1, langfuse-worker 3.215.0-r1, langfuse-worker 3.216.0-r1, langfuse-worker 3.217.0-r1, langfuse-worker 3.218.0-r1, langfuse-worker 3.219.0-r1, langfuse-worker 3.220.0-r1, langfuse-worker 3.221.1-r1, langfuse-worker 3.223.0-r2, langfuse-worker 3.224.0-r1, langfuse-worker 3.224.1-r1, langfuse-worker 3.224.2-r1, langfuse-worker 3.224.4-r1, langfuse-worker 3.225.0-r1, langfuse-worker 4.0.0-r1, langfuse-worker 4.3.0-r1, langfuse-worker 4.3.1-r1, n8n 2.28.0-r2, npm 11.17.0-r2, npm 11.18.0-r2, npm 11.18.0-r4, proxy-agent 6.4.0-r0, proxy-agent 6.5.0-r1, proxy-agent 7.0.0-r2, proxy-agent 8.0.2-r1, pulumi 3.248.0-r0, renovate 44.31.0-r3, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1

CVE-2026-69192 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JX26163 Security fix for CVE-2026-14257 applied in: argo-workflows 3.6.19-r7, langfuse-worker 3.224.0-r3, langfuse-worker 3.224.1-r2, langfuse-worker 3.224.2-r3, langfuse-worker 3.224.4-r1, langfuse-worker 3.225.0-r2, langfuse-worker 4.0.0-r2, langfuse-worker 4.3.0-r1, n8n 2.28.0-r2, npm 11.17.0-r2, npm 11.18.0-r1, npm 11.18.0-r2, pulumi 3.248.0-r0, renovate 44.31.0-r2, renovate 44.32.4-r1, renovate 44.32.5-r1, renovate 44.32.6-r1

CVE-2026-14257 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...