4446 matches found
CVE-2026-12259
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
CVE-2026-12259 Improper Input Validation in nltk/nltk
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
CVE-2026-12259
In nltk version 3.9.4, the "nltk.downloader.Downloader.downloadpackage" function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for "info.url" through a compromised...
CVE-2026-12259 Improper Input Validation in nltk/nltk
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
CVE-2026-12259
The CVE affects nltk 3.9.4: nltk.downloader.Downloader._download_package() can write package bytes to disk and may extract them before SHA-256/MD5 checks, enabling tampering via compromised mirrors or proxies. This could lead to installation of attacker-controlled package bytes (potentially malic...
CVE-2026-12259
In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...
Linux Distros Unpatched Vulnerability : CVE-2026-12259
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing...
PT-2026-67013
Name of the Vulnerable Software and Affected Versions nltk version 3.9.4 Description The nltk.downloader.Downloader. download package function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with t...
SUSE CVE-2026-42575
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...
SUSE CVE-2026-59247
Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...
SUSE CVE-2026-59874
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18...
CVE-2026-44104
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise...
CVE-2026-44104
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise...
EUVD-2026-51039
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise...
Linux net/sched act_csum buffer overflow
The vulnerability of the tcfcsumact function in the net/sched/actcsum.c module of the network/sched subsystem of the Linux operating system is related to the improper checking of the specified index, position, or offset in the input data. Exploiting this vulnerability may allow a remote attacker ...
EUVD-2026-50362
Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...
CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam
Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...
TencentOS Server 4: rsync (TSSA-2026:0743)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0743 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
CVE-2026-64554
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment brip6fragment gets prevhdr, a pointer into the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb skbchecksumhelp reallocates the head via...
EUVD-2026-49605
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in brip6fragment brip6fragment gets prevhdr, a pointer into the skb head, from ip6find1stfragopt, then calls skbchecksumhelp. For a cloned skb skbchecksumhelp reallocates the head via...