CVE-2026-45330 Decidim: Verification admins can access supplied IDs from other organisations

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming currentorganization ownership, allowing an...

CVE-2026-0848

NLTK versions ≤3.9.2 are vulnerable due to the StanfordSegmenter loading external Java .jar files without verification or sandboxing. An attacker can supply or replace the JAR, enabling arbitrary Java bytecode execution at import time via unvalidated classpath input. Potential attack vectors incl...

PT-2026-23514

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.9.3 Description Improper input validation in the StanfordSegmenter module allows for arbitrary code execution. The module dynamically loads external Java .jar files without verification or sandboxing, enabling an...