CVE-2026-62384 NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-62384 NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-62384

NLTK (Python Natural Language Toolkit) versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader . An attacker who can place symlinks with names containing no path separators inside a corpus subdirectory can bypass the path validation guard and read arbitrary XML files...

SUSE CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

SUSE CVE-2026-76018

Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted file. Chromium security severity: High...

SUSE CVE-2026-76020

Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76022

Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-76023

Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-79569

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.9.4 Description A symlink escape issue exists in the CorpusReader.open function. This occurs because path validation is performed lexically and fails to account for symlink resolution. Consequently, a local attacker ca...

Linux Distros Unpatched Vulnerability : CVE-2026-76018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentially execute arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-70626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus...

CVE-2026-70626: Improper Link Resolution Before File Access

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

Linux Distros Unpatched Vulnerability : CVE-2026-76023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process t...

PT-2026-99448

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2 Description An authorization bypass exists in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', the LegacyResolver.customResolve function ...

Linux Distros Unpatched Vulnerability : CVE-2026-76022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...

SUSE SLED15 / SLES15 Security Update : rsync (SUSE-SU-2026:3657-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3657-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist...

PT-2026-79558

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.2 Description A symlink-based sandbox bypass exists in the FramenetCorpusReader. This issue allows attackers to read arbitrary XML files located outside the corpus root. By placing symlinks with names that contain n...

Linux Distros Unpatched Vulnerability : CVE-2026-62384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus...

EUVD-2026-64191

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...

JLSEC-2026-1370

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...