ae.teletronics.nlp:entityextraction (1.3), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +345 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.5.3)

org.apache.opennlp:opennlp-tools MAVEN version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - ae.teletronics.nlp:entityextraction 1.3 - ai.mattmann.mnemosyne:cas-crawler 1.11.0 -...

XML External Entity (XXE) Injection

Overview org.apache.opennlp:opennlp-tools is an is a machine learning based toolkit for the processing of natural language text. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the create method in the DictionaryEntryPersistor class, which initializes a...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +883 more potentially affected by CVE-2026-42027 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42027 Source advisory: SNYK:JAVA-ORGAPACHEOPENNLP-16419373...

Unsafe Reflection

Overview org.apache.opennlp:opennlp-tools is an is a machine learning based toolkit for the processing of natural language text. Affected versions of this package are vulnerable to Unsafe Reflection that leads to arbitrary class instantiation, via the instantiateExtension method in the...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-42440 Source advisory: SNYK:JAVA-ORGAPACHEOPENNLP-16535521...

Memory Allocation with Excessive Size Value

Overview org.apache.opennlp:opennlp-tools is an is a machine learning based toolkit for the processing of natural language text. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the AbstractModelReader class. An attacker can cause the application ...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-42440 Source advisory: MEND:CVE-2026-42440...

ae.teletronics.nlp:entityextraction (1.3), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0) +1808 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=1.5.2-incubating, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =1.5.2-incubating, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42440 Source advisory: MEND:CVE-2026-42440...

CVE-2025-13605

3onedata modbus gateway device model GW1101-1DRS-485-TB-P hardware version V2.2.0 allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the "IP address" field of the diagnosis test tools. This issue has been resolved in firmware...

CVE-2025-13605

3onedata modbus gateway device model GW1101-1DRS-485-TB-P hardware version V2.2.0 allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the "IP address" field of the diagnosis test tools. This issue has been resolved in firmware...

CVE-2025-13605 Shell command injection in 3onedata GW1101-1D(RS-485)-TB-P modbus gateway

3onedata modbus gateway device model GW1101-1DRS-485-TB-P hardware version V2.2.0 allows authenticated users to execute arbitrary shell commands in the context of the root user by providing payload in the "IP address" field of the diagnosis test tools. This issue has been resolved in firmware...

@puchunjie/doc-tools-mcp has a Path Traversal Issue

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function createdocument/opendocument of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The...

@puchunjie/doc-tools-mcp (>=1.0.11, <=1.0.14) potentially affected by CVE-2026-7738 via @puchunjie/doc-tools-mcp (1.0.18)

@puchunjie/doc-tools-mcp NPM version 1.0.18 is affected by a known vulnerability. The following packages have a transitive dependency on @puchunjie/doc-tools-mcp and may be impacted: - @puchunjie/doc-tools-mcp =1.0.11, =1.0.14 Source cves: CVE-2026-7738 Source advisory:...

@puchunjie/doc-tools-mcp (>=1.0.11, <=1.0.14) potentially affected by CVE-2026-7738 via @puchunjie/doc-tools-mcp (1.0.18)

@puchunjie/doc-tools-mcp NPM version 1.0.18 is affected by a known vulnerability. The following packages have a transitive dependency on @puchunjie/doc-tools-mcp and may be impacted: - @puchunjie/doc-tools-mcp =1.0.11, =1.0.14 Source cves: CVE-2026-7738 Source advisory: OSV:GHSA-GCMM-C94J-J47X...

GHSA-GCMM-C94J-J47X @puchunjie/doc-tools-mcp has a Path Traversal Issue

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function createdocument/opendocument of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The...

CVE-2026-7738

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function createdocument/opendocument of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The...

CVE-2026-7738

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function createdocument/opendocument of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The...

CVE-2026-7738

CVE-2026-7738 affects puchunjie doc-tools-mcp 1.0.18, specifically the MCP Interface’s file src/mcp-server.ts, in the functions create_document/open_document. The root cause is manipulation of the argument filePath, leading to a path traversal vulnerability. This could allow remote attackers to a...

CVE-2026-7738 puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversal

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function createdocument/opendocument of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The...

EUVD-2026-26919

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function createdocument/opendocument of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results in path traversal. The attack can be launched remotely. The...