Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cw6x-m8jw-qmrh. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows...

PYSEC-2026-3739

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

CVE-2026-81724 NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion

NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed...

PT-2026-82619

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description An uncontrolled recursion issue exists in the nltk.featstruct.FeatStructReader class. Unauthenticated attackers can trigger a denial of service by providing deeply nested feature-structure input, such ...

CVE-2026-80546

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

FreeBSD Security Advisory - FreeBSD-SA-26:59.mac_do

FreeBSD Security Advisory - In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated fiel...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: drm/meson: fixed the crash that occurs during shutdown when the component is not probed. When the main component is not probed—for example, when the dw-hdmi module is not yet loaded or in a probe defer state—the following crash...

BIT-AUTHENTIK-2026-55106 authentik: Unauthenticated LDAP directory data disclosure

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

ROS-20260824-73-0031

A vulnerability in Mariadb 11.8 exists due to insufficient measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

ROS-20260824-73-0029

The vulnerability in Mariadb 10.6 is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20260824-73-0028

The vulnerability in MariaDB is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Metabase Query Privilege Escalation

The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...

CVE-2026-61663

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...

CVE-2026-54624

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...

django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

GHSA-VGXM-H9GX-H9W7 django CMS: Structure endpoint bypasses page-view permission

Summary The structure-board endpoint renderobjectstructure renders a page's plugin structure without verifying that the requesting user is allowed to view the page. The edit and preview endpoints enforce this via renderpage, but the structure endpoint does not, allowing a low-privileged staff use...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the renderobjectstructure function. An attacker can access sensitive page content by sending requests to the structure endpoint with the content-type id and object id of a view-restricted page. This is only...

CVE-2026-61663 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...

CVE-2026-61663 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, renderobjectstructure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.usestructure or model-level view or chan...