2964 matches found
CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments
NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...
CVE-2025-71408
The CVE-2025-71408 issue affects NLTK up to version 3.9.2 (pre-3.9.3). The vulnerability lies in nltk.collocations’ main path, where command‑line arguments are passed directly to eval() to form BigramAssocMeasures suffixes without a allowlist or sanitization, enabling an attacker who can control ...
CVE-2025-71408 NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments
NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...
CVE-2025-71408
NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...
GHSA-XX22-P4CH-683R LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges
Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the...
GHSA-QHMF-7FC4-8Q3H ImageMagick: Infinite Loop in connected-components when providing invalid arguments
When providing invalid arguments to the connected-components option an infinite loop will occur...
EUVD-2026-41123
ImageMagick: Infinite Loop in connected-components when providing invalid arguments...
ImageMagick: Infinite Loop in connected-components when providing invalid arguments
When providing invalid arguments to the connected-components option an infinite loop will occur...
EUVD-2026-48436
9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....
PT-2026-76489
NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...
CVE-2026-63732 9router before 0.4.60 Remote Code Execution via default password
9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....
CVE-2026-44210
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...
EUVD-2026-48339
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...
CVE-2026-44210: Improper Neutralization of Argument Delimiters in a Command
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...
SUSE CVE-2026-16439
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
CVE-2026-16439
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...
CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...