com.github.paramitamirza:catena (catena), com.github.paramitamirza:catena (>=1.0.1, <=1.0.2) +14 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.5.2-incubating)

org.apache.opennlp:opennlp-tools MAVEN version 1.5.2-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.github.paramitamirza:catena catena - com.github.paramitamirza:catena =1.0.1,...

ae.teletronics.nlp:entityextraction (1.3), ai.mattmann.mnemosyne:cas-crawler (1.11.0) +345 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.5.3)

org.apache.opennlp:opennlp-tools MAVEN version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - ae.teletronics.nlp:entityextraction 1.3 - ai.mattmann.mnemosyne:cas-crawler 1.11.0 -...

com.centit.support:centit-es-client (0.1.1806), com.davidbracewell:hermes-examples (>=0.1, <=0.5) +220 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.6.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - com.centit.support:centit-es-client 0.1.1806 - com.davidbracewell:hermes-examples =0.1, =0.1,...

fr.vsct.tock:tock-bot-admin-server (>=0.4.0, <=0.6.7), fr.vsct.tock:tock-nlp-admin-server (>=0.4.0, <=0.6.7) +18 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.8.1)

org.apache.opennlp:opennlp-tools MAVEN version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - fr.vsct.tock:tock-bot-admin-server =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.1.0, =0.1...

cloud.testload:jmeter-clickhouse-listener (2.00), com.bobpaulin.jmeter:aws-include-controller-plugin (0.0.1) +123 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.0)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - cloud.testload:jmeter-clickhouse-listener 2.00 -...

ai.tock:tock-bot-admin-server (>=20.3.4, <=21.9.3), ai.tock:tock-bot-admin-test-core (>=20.3.4, <=21.9.3) +119 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.3)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - ai.tock:tock-bot-admin-server =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4, =20.3.4,...

org.apache.opennlp:opennlp-brat-annotator (1.9.5), org.apache.opennlp:opennlp-distr (1.9.5) +4 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.5)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - org.apache.opennlp:opennlp-brat-annotator 1.9.5 - org.apache.opennlp:opennlp-distr 1.9.5 -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42440 Source advisory: OSV:GHSA-659W-93R5-9J6M...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-42440 Source advisory: OSV:GHSA-659W-93R5-9J6M...

ai.driftkit:driftkit-embedding-spring-ai (0.6.0), ai.tock:tock-bot-admin-server (>=21.9.4, <=22.3.2) +359 more potentially affected by CVE-2026-42440 via org.apache.opennlp:opennlp-tools (1.9.4)

org.apache.opennlp:opennlp-tools MAVEN version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.opennlp:opennlp-tools and may be impacted: - ai.driftkit:driftkit-embedding-spring-ai 0.6.0 - ai.tock:tock-bot-admin-server =21.9.4, =21.9.4...

ae.teletronics.nlp:entityextraction (1.3), ai.driftkit:driftkit-embedding-spring-ai (0.6.0) +1162 more potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=1.5.2-incubating, <=1.9.4)

org.apache.opennlp:opennlp-tools MAVEN version =1.5.2-incubating, =19.9.0, =19.9.1, =19.9.1, =19.9.0, =19.9.0, =19.9.0, =22.3.2 and more Source cves: CVE-2026-40682 Source advisory: GHSA-4V8G-86X5-3VRC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-40682 Source advisory: GHSA-4V8G-86X5-3VRC...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-40682 Source advisory: OSV:GHSA-4V8G-86X5-3VRC...

ae.teletronics.nlp:entityextraction (1.3), ai.driftkit:driftkit-embedding-spring-ai (0.6.0) +1162 more potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=1.5.2-incubating, <=1.9.4)

org.apache.opennlp:opennlp-tools MAVEN version =1.5.2-incubating, =19.9.0, =19.9.1, =19.9.1, =19.9.0, =19.9.0, =19.9.0, =22.3.2 and more Source cves: CVE-2026-40682 Source advisory: OSV:GHSA-4V8G-86X5-3VRC...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-40682 Source advisory: GHSA-4V8G-86X5-3VRC...

org.apache.opennlp:opennlp-distr (>=3.0.0-m1, <=3.0.0-m2) potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=3.0.0-m1, <=3.0.0-m2)

org.apache.opennlp:opennlp-tools MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m2 Source cves: CVE-2026-40682 Source advisory: OSV:GHSA-4V8G-86X5-3VRC...

XML External Entity (XXE) Injection

Overview org.apache.opennlp:opennlp-tools is an is a machine learning based toolkit for the processing of natural language text. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the create method in the DictionaryEntryPersistor class, which initializes a...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-40682 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-40682 Source advisory: SNYK:JAVA-ORGAPACHEOPENNLP-16419377...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +884 more potentially affected by CVE-2026-42027 via org.apache.opennlp:opennlp-tools (>=2.0.0, <=2.5.8)

org.apache.opennlp:opennlp-tools MAVEN version =2.0.0, =0.1.0, =0.1.0, =2.12.1, =2.12.1, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-42027 Source advisory: SNYK:JAVA-ORGAPACHEOPENNLP-16419373...

Unsafe Reflection

Overview org.apache.opennlp:opennlp-tools is an is a machine learning based toolkit for the processing of natural language text. Affected versions of this package are vulnerable to Unsafe Reflection that leads to arbitrary class instantiation, via the instantiateExtension method in the...