NL
Product
nltk
46
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 4High 28Medium 10Low 4
Watch
Add nltk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-71513 | 8.8 | Aug 22 | NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass Affected: 3.10.0 before 3.10.3 |
| CVE-2025-14009 | 8.8 | Feb 18 | Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution Affected: before 3.9.3 |
| CVE-2026-79674 | 8.2 | Aug 25 | NLTK 3.10.2 Path Traversal via corpus-reader constructors Affected: before 3.10.3 |
| CVE-2026-33236 | 8.1 | Mar 20 | NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite Affected: <= 3.9.3 |
| CVE-2026-78680 | 7.8 | Aug 25 | NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary Affected: before 3.10.3 |
| CVE-2025-71408 | 7.8 | Jul 24 | NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments Affected: before 3.9.3 |
| CVE-2026-12252 | 7.8 | Jul 4 | Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk Affected: through 3.9.3 |
| CVE-2026-81722 | 7.5 | Aug 27 | nltk PorterStemmer before 3.10.3 Quadratic-time DoS Affected: before 3.10.3 |
| CVE-2026-80205 | 7.5 | Aug 26 | NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex Affected: before 3.10.0 |
| CVE-2026-78682 | 7.5 | Aug 25 | NLTK before 3.10.3 SSRF Protection Bypass via Proxy Affected: before 3.10.3 |
| CVE-2026-78681 | 7.5 | Aug 25 | NLTK before 3.10.3 Entity Expansion DoS via ElementTree Affected: before 3.10.3 |
| CVE-2026-66393 | 7.5 | Aug 22 | NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder Affected: before 3.9.4 |
| CVE-2026-63312 | 7.5 | Aug 22 | NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read Affected: before 3.10.0 |
| CVE-2026-62388 | 7.5 | Aug 22 | NLTK before 3.10.0 Insecure Default Configuration in pathsec.py Affected: before 3.10.0 |
| CVE-2026-62385 | 7.5 | Aug 22 | NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers Affected: before 3.10.0 |
| CVE-2026-62384 | 7.5 | Aug 22 | NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2 Affected: 3.10.0 before 3.10.2 |
| CVE-2026-72818 | 7.5 | Aug 20 | NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input Affected: before 3.10.1 |
| CVE-2026-54293 | 7.5 | Jun 22 | NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read Affected: < 3.10.0-rc1 |
| CVE-2026-33231 | 7.5 | Mar 20 | NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app Affected: <= 3.9.3 |
| CVE-2026-0846 | 7.5 | Mar 9 | Arbitrary File Read via Absolute Path Input in nltk.util.filestring() Affected: 3.9.2 |
| CVE-2026-0847 | 7.5 | Mar 4 | Path Traversal in nltk/nltk Affected: through 3.9.2 |
| CVE-2021-3842 | 7.5 | Jan 4 | nltk is vulnerable to Inefficient Regular Expression Complexity Affected: before 3.6.6 |
| CVE-2021-43854 | 7.5 | Dec 23 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing Affected: before 3.6.5 |
| CVE-2021-3828 | 7.5 | Sep 27 | nltk is vulnerable to Inefficient Regular Expression Complexity Affected: through 3.6.3 |
| CVE-2019-14751 | 7.5 | Aug 22 | NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is… Affected: before 3.4.5 |
| CVE-2026-81727 | 7.1 | Aug 27 | NLTK before 3.10.3 Hardlink File Overwrite via downloader Affected: before 3.10.3 |
| CVE-2026-109956 | 7.0 | Oct 13 | NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path Affected: through 3.10.3 |
| CVE-2026-81726 | 7.0 | Aug 27 | NLTK through 3.10.3 Path Traversal via Model-Artifact APIs Affected: through 3.10.3 |
Showing 28