144791 matches found
Untrusted Search Path
Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Untrusted Search Path through the dot2img function in nltk/parse/dependencygraph.py and the AlignedSent.reprsvg method in nltk/translate/api.py...
Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition for Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint
Summary IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU Critical Patch Update CVE-2026-8400, CVE-2026-41254, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-16441, CVE-2026-60147, CVE-2026-46968, CVE-2026-16439, CVE-2026-16243, CVE-2026-47027,...
EUVD-2026-65290
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...
CVE-2026-12561
CVE-2026-12561 affects the tagDiv Composer WordPress plugin in all versions up to and including 5.4.5 . The vulnerability is a Stored Cross-Site Scripting flaw in the vc_raw_html::render() method. The method base64-decodes shortcode content and concatenates the result directly into page HTML with...
CVE-2026-12561 tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...
CVE-2026-12561 tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...
gha-lab-227431b300
Kiwi TCMS - Open-Source-Testmanagement .. image:: https://img.shields.io/docker/pulls/kiwitcms/kiwi :target: https://kiwitcms.readthedocs.io/en/latest/installingdocker.html :alt: Downloads from Docker Hub .. image:: https://readthedocs.org/projects/kiwitcms/badge/?version=latest :target:...
GHSA-GX65-C5HJ-VPV5 Duplicate Advisory: [CWE-502] Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rhp5-r9x4-f5g2. This link is maintained to preserve external references. Original Description NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the...
Duplicate Advisory: [CWE-502] Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rhp5-r9x4-f5g2. This link is maintained to preserve external references. Original Description NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the...
Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jq29-c7v8-rg55. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated...
GHSA-896W-CW95-XQ7W Duplicate Advisory: Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jq29-c7v8-rg55. This link is maintained to preserve external references. Original Description Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated...
PYSEC-2026-3734
NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...
PYSEC-2026-3734
NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...
CVE-2026-78683
NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...
DEBIAN-CVE-2026-78683
NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...
CVE-2026-75575
Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset...
CVE-2026-72699
The Grav Login plugin getgrav/grav-plugin-login before 3.9.1 is vulnerable to email address enumeration. The register method in classes/Login.php throws a distinct exception EMAILNOTAVAILABLE when a submitted email address already belongs to an existing account, while allowing registration to...
CVE-2026-72695
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...
CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...
CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...