CVE-2026-57232

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

GHSA-FG7F-2386-8897 Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Summary ReviewsCorpusReader extracts feature annotations of the form label followed by a bracketed signed digit e.g. a label then +2 from each review line, using the module-level FEATURES regex. The feature-label sub-pattern is unbounded — an optional greedy run of word-plus-whitespace groups...

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Summary ReviewsCorpusReader extracts feature annotations of the form label followed by a bracketed signed digit e.g. a label then +2 from each review line, using the module-level FEATURES regex. The feature-label sub-pattern is unbounded — an optional greedy run of word-plus-whitespace groups...

GHSA-6HM5-JGCP-P838 Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Summary A path-traversal vulnerability in NKJPCorpusReader allows an attacker who can influence the fileids argument of its public read methods header, raw, words, sents, taggedwords to read files outside the corpus root. The reader builds the file path with no containment check and opens it with...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal via the addroot path handling in nltk/corpus/reader/nkjp.py. An attacker can read files outside the corpus root and bypass...

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Summary A path-traversal vulnerability in NKJPCorpusReader allows an attacker who can influence the fileids argument of its public read methods header, raw, words, sents, taggedwords to read files outside the corpus root. The reader builds the file path with no containment check and opens it with...

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

Summary FramenetCorpusReader.framename interpolates a caller-supplied frame name into an XML file path that is read with the builtin open, bypassing CorpusReader.open and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal via FramenetCorpusReader.frame in nltk/corpus/reader/framenet.py. An attacker can read arbitrary XML files by supplying a...

SUSE CVE-2026-44936

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials BasicAuth to any URL specified in the helm.repo...

PT-2026-66837

Name of the Vulnerable Software and Affected Versions Contao versions 5.3.35 through 5.3.47 Contao versions 5.7.0-RC1 through 5.7.8 Description The Feed Reader front-end module fails to validate the scheme or private addresses of configured RSS feed URLs. This occurs because the getResponse...

PT-2026-66886

Name of the Vulnerable Software and Affected Versions nltk versions prior to 3.9.5 Description A path-traversal issue in NKJPCorpusReader allows an attacker to read files outside the designated corpus root by influencing the fileids argument. This occurs because the reader uses plain string...

CVE-2026-57232: Server-Side Request Forgery (SSRF)

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

Specter-FlipperZero v2.1

Specter 👻 Sweep for the readers you can't see. -26E8CA?style=for-the-badge Specter turns your Flipper Zero into a pocket counter-surveillance bug-sweep for active 13.56 MHz NFC readers. It passively listens for the RF field that a powered-on reader is constantly emitting — a hidden card skimmer...

JLSEC-2026-1047 ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when...

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion...

PT-2026-76087

ImageMagick before 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion...

chalice (>=1.22.4, <=1.24.0), dpckan (>=0.0.1.9001, <=0.1.0) +6 more potentially affected by CVE-2026-13346 via pip (21.1.3)

pip PYPI version 21.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.22.4, =0.0.1.9001, =0.9.4, =1.0.0, =2.0.0, =2.1.0 - tikit 0.1.7 - wanikani-notifier 0.1.0 - yelpdataset2sql 0.0.2 Source cves: CVE-2026-13346...

JLSEC-2026-804 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package...

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

CVE-2026-59932

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

CVE-2026-59933

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE...

CVE-2026-59932

CVE-2026-59932 concerns PhpSpreadsheet’s Gnumeric reader. The issue arises when reading attacker-supplied .gnumeric files: if the file starts with gzip magic bytes, the reader decodes the full compressed content via gzdecode() without a decompressed-size cap, which can cause memory exhaustion and...