CVE-2026-12261

A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...

EUVD-2026-54393

A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...

CVE-2026-12261

A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...

Linux Distros Unpatched Vulnerability : CVE-2026-12261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives...

Malicious code in @or-sdk/library-types-v1 (npm)

npm/@or-sdk/library-types-v1 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...