Unrated
CVE-2026-78684
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,801
Reset filters
Critical
CVE-2026-78683
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
Critical
CVE-2026-78676
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE
High
CVE-2026-78677
GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
Medium
CVE-2026-78678
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()
High
CVE-2026-78681
NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
High
CVE-2026-78682
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
High
CVE-2026-78675
GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
Low
CVE-2026-71514
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt
High
CVE-2026-70626
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
High
CVE-2026-63312
NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
Medium
CVE-2026-65915
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
Medium
CVE-2026-66393
Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS
Medium
CVE-2026-63311
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
High
CVE-2026-62384
NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
High
CVE-2026-62385
NLTK: Stable FrameNet and NKJP readers parse outside-root XML
High
CVE-2026-62388
NLTK: Default ENFORCE=False Disables All pathsec Security Controls
Medium
CVE-2026-62383
NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
Medium
ghsa-jm5p-837g-rv8g
Wagtail: Improper restriction handling on Page translation API endpoint
Medium
ghsa-x5cx-w6p2-mxf2
Wagtail: Improper permission handling when copying snippets
Medium
ghsa-c2xx-cjmh-9q8f
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Low
ghsa-92hv-j533-69wc
Wagtail: Identification of documents by SHA1 hash
Medium
ghsa-mc9m-6fm9-pghc
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
Medium
ghsa-jgvr-6x5w-hx5w
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.