Incomplete Fix for CVE-2026-0848: 5 Stanford Interface Classes Still Vulnerable to Untrusted JAR Code Execution

Description CVE-2026-0848 fixed untrusted JAR code execution in StanfordSegmenter by adding SHA256 verification in PR 3477. However, the fix was ONLY applied to nltk/tokenize/stanfordsegmenter.py. Five other Stanford interface classes have the identical vulnerability — they accept user-controllab...

SUSE CVE-2026-0848

NLTK versions =3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the execution of...

CVE-2026-0848

creationtimestamp| type| source ---|---|--- 2026-03-05 22:06:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsn3da7y2o 2026-03-06 22:56:29+00:00| seen| https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mggfvehltd2x 2026-03-07 15:00:45+00:00| seen|...

MiracleLinux 7 : libwmf-0.2.8.4-41.el7 (AXSA:2015-512:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-512:01 advisory. A library for reading and converting Windows MetaFile vector graphics WMF. Security issues fixed with this release: CVE-2015-0848 Heap-based buffer...

EUVD-2012-0848

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2015-0848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted BMP...

CVE-2025-0848

creationtimestamp| type| source ---|---|--- 2025-01-30 01:33:16+00:00| seen| https://infosec.exchange/users/cve/statuses/113914727312277831 2025-01-30 02:16:21+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgwg3kux642t 2025-01-30 03:18:43+00:00|...

CVE-2024-0848

The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-0848 AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoice

The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

WordPress AA Cash Calculator Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software AA Cash Calculator Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0848 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0f4d37bdc2c4 Credits Nathaniel Oh 0x4n3...

Oracle Linux 9 : .NET / 8.0 (ELSA-2024-0848)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0848 advisory. 8.0.102-2.0.1 - Update to .NET SDK 8.0.102 and Runtime 8.0.2 - Add -dbg subpackages for symbol files - Resolves: RHEL-23070 Tenable has extracted the...

AlmaLinux 9 : .NET 8.0 (ALSA-2024:0848)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0848 advisory. - .NET Denial of Service Vulnerability CVE-2024-21386, CVE-2024-21404 Note that Nessus has not tested for these issues but has instead relied only on the...

Debian: Security Advisory (DLA-253-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : php:8.0 (ELSA-2023-0848)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0848 advisory. php 8.0.27-1 - rebase to 8.0.27 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessu...

Rocky Linux 8 : php:8.0 (RLSA-2023:0848)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0848 advisory. - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute...

RHEL 8 : php:8.0 (RHSA-2023:0848)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0848 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later...

CentOS 8 : php:8.0 (CESA-2023:0848)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0848 advisory. - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files, resulting in an infinite...

CVE-2023-0848

creationtimestamp| type| source ---|---|--- 2023-02-16 00:36:53+00:00| seen| https://t.me/cibsecurity/58289...

CVE-2023-0848 Netgear WNDR3700v2 Web Management Interface denial of service

A vulnerability was found in Netgear WNDR3700v2 1.0.1.14. It has been rated as problematic. This issue affects some unknown processing of the component Web Management Interface. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to th...

CVE-2023-0848

CVE-2023-0848 affects Netgear WNDR3700v2 router (firmware 1.0.1.14) through the Web Management Interface. The vulnerability is caused by unknown processing in that component, enabling a remote attacker to trigger a denial of service. Exploitation is possible remotely, and the exploit has been pub...