Astra Linux – Vulnerability in Policykit-1

A flaw was discovered in polkit. When processing an XML policy with 32 or more nested elements at depth, an out-of-bounds write vulnerability can be triggered. This issue may lead to a crash or other unexpected behavior, and arbitrary code execution is possible without being detected. To exploit...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26, and 8.0.x below 8.0.13, certain XML parsing functions, such as simplexmlloadfile, decode the filename passed to them using URL encoding. If the filename contains a URL-encoded NUL character, this may cause the function to interpret this as t...

Astra Linux – Vulnerability in netcdf

A issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxmlstr2utf8, when parsing a crafted XML file, performs zero-length reallocation in ezxml.c, resulting in a NULL pointer being returned in some compilers. After this, the function ezxmlparsestr does not check whether the s variabl...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. The algorithmic complexity in django.core.serializers.xmlserializer.getInnerText allows a remote attacker to trigger a potential denial-of-service attack, resulting in CPU and memory exhaustion through specially...

Astra Linux – Vulnerability in expat, libxmltok

A issue was discovered in libexpat before version 2.6.3. In xmlparse.c, a negative length value for XMLParseBuffer is allowed without being rejected...

Astra Linux – Vulnerability in Jackson-Databind

A flaw was discovered in FasterXML Jackson Databind; it does not properly secure entity expansion. This flaw exposes the system to XML external entity XXE attacks. The most significant threat from this vulnerability is data integrity...

Astra Linux – Vulnerability in tinyxml

In TinyXML versions up to 2.6.2, there is an infinite loop in the TiXmlParsingData::Stamp method within tinyxmlparser.cpp, specifically due to the TIXMLUTFLEAD0 case. This issue can be triggered by a specially crafted XML message and leads to a denial of service...

Astra Linux – Vulnerability in libxslt

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...

RHEL 9 : assertj-core (RHSA-2026:58957)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58957 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...

The vulnerability of the XML component in the Firefox web browser allows a hacker to trigger a service failure.

The vulnerability of the XML component in the Firefox web browser is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

RHEL 9 : assertj-core (RHSA-2026:58956)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58956 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...

RHEL 9 : assertj-core (RHSA-2026:58949)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58949 advisory. A rich and intuitive set of strongly-typed assertions to use for unit testing either with JUnit or TestNG. Security Fixes: assertj: AssertJ:...

External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path via path handling in FramenetCorpusReader and NKJPCorpusReader. An attacker can read and parse arbitrary...

CVE-2026-62385

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit framebyname, doc, lu, and header methods wi...

CVE-2026-62385

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit framebyname, doc, lu, and header methods wi...

CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

UBUNTU-CVE-2026-62385

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit framebyname, doc, lu, and header methods wi...

CVE-2026-62385 NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit framebyname, doc, lu, and header methods wi...

CVE-2026-62385 NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit framebyname, doc, lu, and header methods wi...