Low
CVE-2026-71514
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,355
Reset filters
High
CVE-2026-70626
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
High
CVE-2026-63312
NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
Medium
CVE-2026-65915
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
Medium
CVE-2026-66393
Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
Medium
CVE-2026-63311
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
High
CVE-2026-62384
NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
High
CVE-2026-62385
NLTK: Stable FrameNet and NKJP readers parse outside-root XML
High
CVE-2026-62388
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
Medium
CVE-2026-62383
NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
Medium
ghsa-jm5p-837g-rv8g
Wagtail: Improper restriction handling on Page translation API endpoint
Medium
ghsa-x5cx-w6p2-mxf2
Wagtail: Improper permission handling when copying snippets
Medium
ghsa-c2xx-cjmh-9q8f
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Low
ghsa-92hv-j533-69wc
Wagtail: Identification of documents by SHA1 hash
Medium
ghsa-mc9m-6fm9-pghc
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
Medium
CVE-2026-76239
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
High
CVE-2026-55253
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
Medium
CVE-2026-102734
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
High
ghsa-p77j-g7h5-r2vw
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
High
CVE-2026-76221
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
High
CVE-2026-76222
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
High
CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Medium
CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
High
CVE-2026-71308
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.