Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in
ApacheOpennlp*

3 matches found

CVE
CVE•added 2026/05/04 4:55 p.m.•54 views

CVE-2026-40682

CVE-2026-40682 (Apache OpenNLP) XXE in DictionaryEntryPersistor via unsanitized dictionary parsing. The DictionaryEntryPersistor initializes a static SAXParserFactory at class-load time without enabling secure features, leaving DOCTYPE processing and external entity resolution enabled. When Dicti...

9.1CVSS5.8AI score0.00515EPSS
CVE
CVE•added 2026/05/04 4:40 p.m.•28 views

CVE-2026-42440

CVE-2026-42440 affects Apache OpenNLP, specifically AbstractModelReader. The vulnerability arises when getOutcomes(), getOutcomePatterns(), and getPredicates() read a 32-bit signed count from a binary model stream and allocate arrays (String[numOutcomes], int[numOCTypes][], String[NUM_PREDS]) wit...

7.5CVSS5.8AI score0.00627EPSS
CVE
CVE•added 2026/05/04 4:43 p.m.•26 views

CVE-2026-42027

The CVE-2026-42027 issue affects Apache OpenNLP ExtensionLoader: ExtensionLoader.instantiateExtension(Class, String) uses Class.forName() to load a class name from a model archive manifest and invokes its no-arg constructor. Although the isAssignableFrom check filters types after loading, Class.f...

9.8CVSS6AI score0.00692EPSS