CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-65915

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

UBUNTU-CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

UBUNTU-CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-2996

The Advanced Product Fields Product Addons for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validatecartdata' function. This makes it possible for unauthenticated attackers to bypass...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626 NLTK before 3.9.4 Symlink Escape via CorpusReader

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-68766

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code...

CVE-2026-65915 NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-65915 NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-65915 NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer

NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load to read arbitrary files accessible to the...

CVE-2026-63311 NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-63311 NLTK before 3.10.0 SSRF via DNS Resolution Failure

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

CVE-2026-62384 NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-62384

NLTK (Python Natural Language Toolkit) versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader . An attacker who can place symlinks with names containing no path separators inside a corpus subdirectory can bypass the path validation guard and read arbitrary XML files...

CVE-2026-62384 NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...