High, CVSS 8.2
NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79676 · GHSA-p4rw-rvv2-7xwr · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–89 of 89 matching · newest first
- Critical, CVSS 9.3
NLTK: Allowlisted pickle loaders still permit code execution in current source
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-79657 · GHSA-x99w-6fgc-pmfw · amended
- High, CVSS 8.7
NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-78681 · GHSA-97qj-x29f-37w7 · amended
- High, CVSS 8.7
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
PyPI nltk · Upgrade to 3.10.3 or later · <= 3.10.2 · CVE-2026-78682 · GHSA-6ww7-3frv-cqxh · amended
- Critical, CVSS 9.4
NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-78683 · GHSA-rhp5-r9x4-f5g2 · amended
- Medium, CVSS 6.8
NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely
PyPI nltk · Upgrade to 3.10.2 or later · >= 3.10.0, < 3.10.2 · CVE-2026-62383 · GHSA-3hhw-38pf-pxj6 · amended
- High, CVSS 8.7
NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)
PyPI nltk · Upgrade to 3.10.2 or later · >= 3.10.0, < 3.10.2 · CVE-2026-62384 · GHSA-f833-7jw8-xwrv · amended
- High, CVSS 8.2
NLTK: Stable FrameNet and NKJP readers parse outside-root XML
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-62385 · GHSA-568f-pv23-39p4 · amended
- Medium, CVSS 5.3
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-12259 · GHSA-5wp5-5229-5g6q · amended
- High, CVSS 8.7
NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.4 · CVE-2026-63312 · GHSA-x5ph-mj9p-rfr8 · amended
- High, CVSS 7.1
NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol
PyPI nltk · Upgrade to 3.10.0 or later · <= 3.9.3 · CVE-2026-65915 · GHSA-72r2-7mfr-5xr9 · amended
- High, CVSS 8.6
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
PyPI nltk · Upgrade to 3.9.4 or later · <= 3.9.3 · CVE-2026-70626 · GHSA-r6gq-whwq-mvg9 · amended
- Unrated
WaveFormat::parsereads past the end of a&WAVEFORMATEXcrates.io wasapi · Upgrade to 0.25.0 or later · >= 0.20.0, < 0.25.0
- Critical, CVSS 9.4
@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
npm @sap/cds-mtxs · Upgrade to 4.0.3, 3.9.7, 2.7.7 or 1.18.4 by release line · >= 4.0.1, < 4.0.3; >= 3.0.1, < 3.9.7; >= 2.0.2, < 2.7.7; < 1.18.4 · CVE-2026-76969 · GHSA-955m-rr6m-2f9v · amended
A vendor fix does not resolve your finding until you verify it in your own systems.