CVE-2026-63312

creationtimestamp| type| source ---|---|--- 2026-08-22 21:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtp67lynrr2r 2026-08-24 12:11:36+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117150416497083462 2026-09-08 16:35:10+00:00|...

DEBIAN-CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...