CVE-2026-79657

NLTK (Python Natural Language Toolkit) versions before 3.10.3 are affected by a remote code execution vulnerability in its allowlisted pickle deserialization mechanism. The root cause is that the safe pickle loaders trust entire module namespaces rather than restricting to specific safe callables...

EUVD-2026-65440

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

CVE-2026-58116 LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into...