CVE-2026-69445

CVE-2026-69445 is a local privilege escalation vulnerability in Windows Compressed Folder caused by an improper limitation of a pathname to a restricted directory (path traversal ). An authorized attacker with low privileges can exploit this locally without user interaction to achieve high impact...

CVE-2026-81377

Visual Studio Code is affected by a path traversal vulnerability that allows an unauthorized attacker to perform tampering over a network. The attack vector is network-based with low complexity and no required privileges, but user interaction is required . The impact is rated HIGH for integrity ,...

EUVD-2026-73333

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...

CVE-2026-78461

Visual Studio Code is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to bypass a security feature over a network. The flaw requires user interaction but no prior authentication. Per the CNA (Microsoft),...

EUVD-2026-73297

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-73114

Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally...

CVE-2026-72948

CVE-2026-72948 is a relative path traversal vulnerability in Windows DNS that allows an authorized attacker to escalate privileges locally . Microsoft rates it MEDIUM (CVSS 6.7) requiring high privileges, while NVD assigns HIGH (7.8) with low privileges required. CISA's SSVC assesses no known exp...

EUVD-2026-73177

Improper limitation of a pathname to a restricted directory 'path traversal' in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-62801

CVE-2026-62801 is a path traversal vulnerability in Windows PowerShell that allows an unauthorized, remote attacker to bypass a security feature. The improper limitation of a pathname to a restricted directory means an attacker can reference files or resources outside the intended directory. The ...

python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination

A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...

EUVD-2026-65524

NLTK: Corpus Reader Sandbox Bypass...

GHSA-3GQ4-3J92-5W49 NLTK: Corpus Reader Sandbox Bypass

Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...

EUVD-2026-65526

NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement...

GHSA-P4RW-RVV2-7XWR NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...

NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...

GHSA-3HHW-38PF-PXJ6 NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

GHSA-F833-7JW8-XWRV NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

GHSA-568F-PV23-39P4 NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...