A vulnerability (CVE-2026-98432) has been identified in the Linux implementation of Multipath TCP (MPTCP), a TCP extension introduced in 2020 to allow multiple network paths for a single TCP connection. MPTCP enables seamless switching between network interfaces and better bandwidth utilization. The vulnerability concerns the Linux MPTCP implementation as specified in RFC 8684. No specific exploit details or impact scenarios are provided. MPTCP is primarily observed in iOS/iPadOS and is detectable by inspecting TCP option 30 in network traffic.
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
The Florida Department of Education's student financial aid website was breached, potentially exposing personal data of approximately 4.9 million individuals. The compromised data may include names, Social Security numbers, dates of birth, addresses, phone numbers, email addresses, and gender codes. The breach was discovered on October 19, 2026, and has since been contained. The department has not disclosed the attack vector or threat actor. Existing student aid and disbursements remain unaffected.
A phishing campaign impersonates OpenAI by sending fake ChatGPT Plus billing emails claiming failed subscription payments. Victims are directed to fraudulent payment pages hosted on compromised WordPress sites under Nexcess's nxcli.io infrastructure. Attackers monitor submitted credit card details in real time and dynamically request one-time passwords (OTPs) to complete fraudulent transactions. The campaign uses multiple redirect domains and identical client-side code across instances to steal credit card information and OTPs.
Chainlit version 2.12.0 contains a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to bypass path-scoped MCP allowed_urls restrictions by exploiting improper validation of semicolon characters in URLs. Attackers can submit specially crafted URLs with '..;' segments to the /mcp endpoint, enabling requests to unauthorized paths on origins that strip semicolon path parameters. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity.
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, enabling Lua console abuse.
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
LaraDashboard versions before 1.4.9 have a stored cross-site scripting (XSS) vulnerability. Authenticated users with post.create or post.edit permissions can inject malicious scripts via unsanitized LaraBuilder design_json block content. This allows script or event-handler markup to execute in administrator or Superadmin sessions when viewing the builder, preview, or page. The vulnerability is fixed in version 1.4.9.
LaraDashboard versions before 1.4.5 have an incorrect authorization vulnerability in the SettingPolicy::manageCoreUpgrades() function. This flaw allows administrators without Superadmin privileges but with settings.edit permission to perform Superadmin-only core upgrade operations. Exploitation enables access to backup, download, restore, and upgrade actions that can expose database dumps containing password hashes and allow site restoration or upgrades.
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
python-jose versions up to 3.5.0 contain a critical authentication bypass vulnerability due to improper verification of cryptographic signatures. The issue arises because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets, allowing attackers to forge JSON Web Tokens (JWTs) with arbitrary claims when the verification key is empty. This flaw affects HS256, HS384, and HS512 algorithms and can lead to unauthorized access if exploited.
CVE-2026-120458 is an infinite loop vulnerability in Ultra Video Group's Kvazaar encoder up to version 2.3.2. It occurs in the read_header() function when processing a truncated Y4M header lacking a terminating newline. This causes the encoder to hang indefinitely, consuming a full CPU core.
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or leak adjacent memory into decoded samples.
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data, stalling the stream position and corrupting heap memory to crash applications.
CVE-2026-120455 is an out-of-bounds write vulnerability in rapidyaml versions up to 0.16.0. It occurs in the ParseEngine::_add_annotation() function when processing YAML input with excessive anchors or tags, leading to stack memory corruption and potential process crashes.
The Sleuth Kit up to version 4.15.0 has a NULL pointer dereference vulnerability in the decmpfs_decompress_lzvn_attr() function. This flaw can be triggered by supplying a crafted HFS+ image with a specially manipulated LZVN inline com.apple.decmpfs attribute that sets an excessively large uncompressed size. The vulnerability causes a denial of service by crashing the tool due to a failed allocation and subsequent NULL pointer write.
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.
libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.
CVE-2026-120451 is a high-severity vulnerability in libgphoto2 up to version 2.5.34. It involves stack-based and heap-based buffer overflows in the jl2005c_init() function caused by malicious USB devices supplying an unbounded allocation table entry count. This can lead to memory corruption, including overwriting the saved return address and heap data, potentially allowing code execution.