Apache Camel code injection vulnerability

Versions of Apache Camel from 4.4.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a code injection vulnerability. This vulnerability arises when the dynamic-router-control endpoint processes subscription or update requests. It involves accessing subscription predicates and expression languages from...

CVE-2026-98763 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

CVE-2026-98763

A vulnerability exists in the Linux kernel USB core regarding how non-zero control endpoints are handled. In usb_enable_endpoint() , non-zero control endpoints populate both dev->ep_in[epnum] and dev->ep_out[epnum] with the same pointer. However, usb_disable_endpoint() fails to clear both s...

EUVD-2026-103848

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

CVE-2026-98763

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

CVE-2026-98714

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erapctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior...

CVE-2026-98694

The Linux kernel contains a use-after-free vulnerability within the thunderbolt component during control channel operations. The issue occurs when a request is canceled; specifically, if tb_cfg_request_work() completes just before tb_cfg_request_cancel() starts, it may re-queue work for a request...

CVE-2026-98694 thunderbolt: Fix KASAN reported use-after-free when request is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

EUVD-2026-103948

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

CVE-2026-98694 thunderbolt: Fix KASAN reported use-after-free when request is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

CVE-2026-110880

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

CVE-2026-110365

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

CVE-2026-110383

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

EUVD-2026-103431

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

CVE-2026-110880 WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

CVE-2026-110880

The Kit (formerly ConvertKit) WordPress plugin (versions

CVE-2026-110880 WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kit Kit formerly ConvertKit convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit: from n/a through 3.4.6...

EUVD-2026-103426

Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent...

EUVD-2026-103420

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...

CVE-2026-110365 WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14...