{"kind": "product", "path": "vulns/debian-12/nltk", "name": "nltk", "product": "nltk", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-109956", "noindex": false, "published": "2026-10-13T13:27:20.244Z", "modified": "2026-10-13T13:27:20.244Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00318, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-109956", "title": "NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path", "description": "NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-j456-xh4h-cpf2", "https://www.vulncheck.com/advisories/nltk-through-3.10.3-path-traversal-via-wekaclassifier-model-path", "https://nvd.nist.gov/vuln/detail/CVE-2026-109956"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81727", "noindex": false, "published": "2026-08-27T14:51:19.564Z", "modified": "2026-08-27T17:43:34.469Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00187, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81727", "title": "NLTK before 3.10.3 Hardlink File Overwrite via downloader", "description": "NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-f794-5jv7-7672", "https://www.vulncheck.com/advisories/nltk-before-3.10.3-hardlink-file-overwrite-via-downloader", "https://nvd.nist.gov/vuln/detail/CVE-2026-81727"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81726", "noindex": false, "published": "2026-08-27T14:51:18.838Z", "modified": "2026-08-27T19:29:23.489Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00339, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81726", "title": "NLTK through 3.10.3 Path Traversal via Model-Artifact APIs", "description": "NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-8mgp-746c-j5xp", "https://www.vulncheck.com/advisories/nltk-through-3.10.3-path-traversal-via-model-artifact-apis", "https://nvd.nist.gov/vuln/detail/CVE-2026-81726"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81725", "noindex": false, "published": "2026-08-27T14:51:18.082Z", "modified": "2026-08-28T15:58:35.166Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00369, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81725", "title": "NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader", "description": "NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj", "https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader", "https://nvd.nist.gov/vuln/detail/CVE-2026-81725"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81724", "noindex": false, "published": "2026-08-27T14:51:17.358Z", "modified": "2026-08-27T18:29:04.021Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00456, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81724", "title": "NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion", "description": "NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-cw6x-m8jw-qmrh", "https://www.vulncheck.com/advisories/nltk-before-3.10.3-denial-of-service-via-uncontrolled-recursion", "https://nvd.nist.gov/vuln/detail/CVE-2026-81724"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81723", "noindex": false, "published": "2026-08-27T14:51:16.614Z", "modified": "2026-08-31T18:12:57.437Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00281, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81723", "title": "NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView", "description": "NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-vp2x-qp44-57v7", "https://www.vulncheck.com/advisories/nltk-before-3.10.3-quadratic-cpu-exhaustion-via-xmlcorpusview", "https://nvd.nist.gov/vuln/detail/CVE-2026-81723"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-81722", "noindex": false, "published": "2026-08-27T14:51:15.857Z", "modified": "2026-08-27T17:49:54.623Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00521, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-81722", "title": "nltk PorterStemmer before 3.10.3 Quadratic-time DoS", "description": "nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-ww6m-cw3f-q94g", "https://www.vulncheck.com/advisories/nltk-porterstemmer-before-3.10.3-quadratic-time-dos", "https://nvd.nist.gov/vuln/detail/CVE-2026-81722"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-80206", "noindex": false, "published": "2026-08-26T10:28:15.035Z", "modified": "2026-08-26T12:52:23.513Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-80206", "title": "NLTK 3.10.2 Regular Expression Denial of Service via tgrep", "description": "NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7", "https://www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep", "https://nvd.nist.gov/vuln/detail/CVE-2026-80206"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-80205", "noindex": false, "published": "2026-08-26T10:28:14.352Z", "modified": "2026-09-01T22:06:44.235Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00651, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-80205", "title": "NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex", "description": "NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55", "https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-unvalidated-regex", "http://www.openwall.com/lists/oss-security/2026/09/01/3"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-79676", "noindex": false, "published": "2026-08-25T15:16:01.646Z", "modified": "2026-08-25T16:15:13.359Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00447, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-79676", "title": "NLTK before 3.10.3 Path Traversal via Symlink Bypass", "description": "NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms().", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-p4rw-rvv2-7xwr", "https://www.vulncheck.com/advisories/nltk-before-path-traversal-via-symlink-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-79676"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-79675", "noindex": false, "published": "2026-08-25T15:16:00.949Z", "modified": "2026-08-27T16:24:50.205Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00775, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-79675", "title": "NLTK before 3.10.3 JVM Argument Injection via Per-Call Options", "description": "NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-m4rf-3fr8-xwx3", "https://www.vulncheck.com/advisories/nltk-before-jvm-argument-injection-via-per-call-options", "https://nvd.nist.gov/vuln/detail/CVE-2026-79675"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-79674", "noindex": false, "published": "2026-08-25T15:16:00.226Z", "modified": "2026-08-25T17:42:56.934Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00387, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-79674", "title": "NLTK 3.10.2 Path Traversal via corpus-reader constructors", "description": "NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49", "https://www.vulncheck.com/advisories/nltk-path-traversal-via-corpus-reader-constructors", "https://nvd.nist.gov/vuln/detail/CVE-2026-79674"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-79657", "noindex": false, "published": "2026-08-25T11:33:22.645Z", "modified": "2026-10-08T15:25:11.080Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.01267, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-79657", "title": "NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization", "description": "NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-x99w-6fgc-pmfw", "https://www.vulncheck.com/advisories/nltk-before-3.10.3-remote-code-execution-via-unsafe-pickle-deserialization", "https://nvd.nist.gov/vuln/detail/CVE-2026-79657"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-78683", "noindex": false, "published": "2026-08-25T01:30:39.451Z", "modified": "2026-08-25T15:19:32.286Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.0051, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78683", "title": "NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization", "description": "NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production c", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2", "https://www.vulncheck.com/advisories/nltk-before-remote-code-execution-via-unsafe-pickle-deserialization", "https://nvd.nist.gov/vuln/detail/CVE-2026-78683"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-78682", "noindex": false, "published": "2026-08-25T01:30:38.486Z", "modified": "2026-10-08T15:25:10.277Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00435, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78682", "title": "NLTK before 3.10.3 SSRF Protection Bypass via Proxy", "description": "NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-cho", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh", "https://www.vulncheck.com/advisories/nltk-before-ssrf-protection-bypass-via-proxy", "https://nvd.nist.gov/vuln/detail/CVE-2026-78682"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-78681", "noindex": false, "published": "2026-08-25T01:30:37.749Z", "modified": "2026-08-26T16:12:19.369Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00521, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78681", "title": "NLTK before 3.10.3 Entity Expansion DoS via ElementTree", "description": "NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7", "https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtree", "https://nvd.nist.gov/vuln/detail/CVE-2026-78681"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-78680", "noindex": false, "published": "2026-08-25T01:30:37.044Z", "modified": "2026-08-25T12:43:04.211Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00177, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-78680", "title": "NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary", "description": "NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent._repr_svg_, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can exploit bare-name binary resolution on Windows via the current working directory or on Unix-like systems via relative PATH entries to execute their binary instead of the legitimate Graphviz tool.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-6hwm-xvph-95vm", "https://www.vulncheck.com/advisories/nltk-before-arbitrary-code-execution-via-graphviz-dot-binary", "https://nvd.nist.gov/vuln/detail/CVE-2026-78680"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-63310", "noindex": false, "published": "2026-08-22T15:16:19.100Z", "modified": "2026-09-15T05:00:45.685020684Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-63310", "title": "DEBIAN-CVE-2026-63310", "description": "DEBIAN-CVE-2026-63310", "references": ["https://security-tracker.debian.org/tracker/CVE-2026-63310", "https://osv.dev/vulnerability/DEBIAN-CVE-2026-63310"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-70626", "noindex": false, "published": "2026-08-22T14:12:44.983Z", "modified": "2026-08-24T19:49:30.565Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.002, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-70626", "title": "NLTK before 3.9.4 Symlink Escape via CorpusReader", "description": "NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9", "https://www.vulncheck.com/advisories/nltk-before-symlink-escape-via-corpusreader", "https://nvd.nist.gov/vuln/detail/CVE-2026-70626"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-66393", "noindex": false, "published": "2026-08-22T14:12:42.072Z", "modified": "2026-08-26T17:55:08.015Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00521, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-66393", "title": "NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder", "description": "NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.", "references": ["https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw", "https://www.vulncheck.com/advisories/nltk-before-denial-of-service-via-jsontaggeddecoder", "https://nvd.nist.gov/vuln/detail/CVE-2026-66393"], "fixes": [], "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}]}], "total": 54, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nltk", "path": "vulns/debian-12/nltk", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 1, "kev": 0}, "lastmod": "2026-10-13T13:27:20.244Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}