NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.3 · CVE-2026-65915 · GHSA-72r2-7mfr-5xr9 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.3 · CVE-2026-65915 · GHSA-72r2-7mfr-5xr9 · amended
PyPI nltk · Upgrade to 3.9.4 or later · <= 3.9.3 · CVE-2026-70626 · GHSA-r6gq-whwq-mvg9 · amended
npm @sap/cds-mtxs · Upgrade to 4.0.3, 3.9.7, 2.7.7 or 1.18.4 by release line · >= 4.0.1, < 4.0.3; >= 3.0.1, < 3.9.7; >= 2.0.2, < 2.7.7; < 1.18.4 · CVE-2026-76969 · GHSA-955m-rr6m-2f9v · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.