GHSA-CV2G-M8RR-888C Duplicate Advisory: Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rf74-v2fm-23pw. This link is maintained to preserve external references. Original Description NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows...

PYSEC-2026-3724

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

PYSEC-0000-CVE-2026-66393

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393

NLTK versions before 3.9.4 are affected by an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() . An attacker can supply a deeply nested JSON structure that exceeds Python's recursion limit, triggering an unhandled RecursionError that crashes the process, resulting in denial of ...

EUVD-2026-64310

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393 NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66393 NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionErro...

CVE-2026-66916

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-66916 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-66916 Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-66916

JoomGallery (a Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 contain an unauthenticated access control bypass in its category JSON view. When a gallery category is password-protected, the HTML view correctly enforces the password gate, but the JSON view (format=json) skips t...

EUVD-2026-64249

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

CVE-2026-66916: Improper Access Control

Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the...

PT-2026-79526

Name of the Vulnerable Software and Affected Versions JoomGallery versions prior to 4.3.1 Description An unauthenticated access control bypass exists in the category JSON view. While the HTML view correctly enforces password protection for gallery categories, the JSON view fails to perform this...

Linux Distros Unpatched Vulnerability : CVE-2026-66393

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decodeobj that allows attackers to cause denial of service by...

json-flattener:UnflattenFuzzer: Security exception in com.github.wnameless.json.unflattener.JsonUnflattener.unflattenArray

Project: https://github.com/wnameless/json-flattener.git Detailed Report: https://oss-fuzz.com/testcase?key=5123059544293376 Project: json-flattener Fuzzing Engine: libFuzzer Fuzz Target: UnflattenFuzzer Job Type: libfuzzerasanjson-flattener Platform Id: linux Crash Type: Security exception Crash...

mcpsnoop v0.19.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

json-flattener:UnflattenFuzzer: Security exception in com.github.wnameless.json.unflattener.JsonUnflattener.unflattenArray

Project: https://github.com/wnameless/json-flattener.git Detailed Report: https://oss-fuzz.com/testcase?key=4518232036540416 Project: json-flattener Fuzzing Engine: libFuzzer Fuzz Target: UnflattenFuzzer Job Type: libfuzzerasanjson-flattener Platform Id: linux Crash Type: Security exception Crash...

CVE-2026-77415

JSONata (a JSON query and transformation language) is vulnerable to arbitrary code execution in versions prior to 1.8.8 and 2.2.1 . An attacker can craft JSONata expressions that chain multiple object-integrity weaknesses—overwriting $clone, exposing internal functions via $merge.*, replacing pro...