EUVD-2026-73114

Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally...

CVE-2026-72948

CVE-2026-72948 is a relative path traversal vulnerability in Windows DNS that allows an authorized attacker to escalate privileges locally . Microsoft rates it MEDIUM (CVSS 6.7) requiring high privileges, while NVD assigns HIGH (7.8) with low privileges required. CISA's SSVC assesses no known exp...

EUVD-2026-73177

Improper limitation of a pathname to a restricted directory 'path traversal' in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-62801

CVE-2026-62801 is a path traversal vulnerability in Windows PowerShell that allows an unauthorized, remote attacker to bypass a security feature. The improper limitation of a pathname to a restricted directory means an attacker can reference files or resources outside the intended directory. The ...

python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination

A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...

GHSA-3GQ4-3J92-5W49 NLTK: Corpus Reader Sandbox Bypass

Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...

EUVD-2026-65524

NLTK: Corpus Reader Sandbox Bypass...

EUVD-2026-65526

NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement...

GHSA-P4RW-RVV2-7XWR NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...

NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...

GHSA-3HHW-38PF-PXJ6 NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

GHSA-F833-7JW8-XWRV NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

EUVD-2026-64337

NLTK: Stable FrameNet and NKJP readers parse outside-root XML...

GHSA-568F-PV23-39P4 NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...

NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...

Exploit for CVE-2026-74239

CVE-2026-74239 XenForo before 2.3.13 is vulnerable to path tr...

Security update for multipath-tools

This update for multipath-tools fixes the following issues: Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. Path traversal in device-mapper-multipath failedwwids management bsc1277210. SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows bsc127721...

SUSE-SU-2026:4093-1 Security update for multipath-tools

This update for multipath-tools fixes the following issues: - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in device-mapper-multipath failedwwids management bsc1277210. - SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows...