NL
Vendor
nltk
55
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109956 | NL nltk nltk | 7.0 | Oct 13 | NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path |
| CVE-2026-81727 | NL nltk nltk | 7.1 | Aug 27 | NLTK before 3.10.3 Hardlink File Overwrite via downloader |
| CVE-2026-81726 | NL nltk nltk | 7.0 | Aug 27 | NLTK through 3.10.3 Path Traversal via Model-Artifact APIs |
| CVE-2026-81725 | NL nltk nltk | 3.7 | Aug 27 | NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader |
| CVE-2026-81724 | NL nltk nltk | 5.3 | Aug 27 | NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion |
| CVE-2026-81723 | NL nltk nltk | 3.7 | Aug 27 | NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView |
| CVE-2026-81722 | NL nltk nltk | 7.5 | Aug 27 | nltk PorterStemmer before 3.10.3 Quadratic-time DoS |
| CVE-2026-80206 | NL nltk nltk | 5.9 | Aug 26 | NLTK 3.10.2 Regular Expression Denial of Service via tgrep |
| CVE-2026-80205 | NL nltk nltk | 7.5 | Aug 26 | NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex |
| CVE-2026-79676 | NL nltk nltk | 5.9 | Aug 25 | NLTK before 3.10.3 Path Traversal via Symlink Bypass |
| CVE-2026-79675 | NL nltk nltk | 9.8 | Aug 25 | NLTK before 3.10.3 JVM Argument Injection via Per-Call Options |
| CVE-2026-79674 | NL nltk nltk | 8.2 | Aug 25 | NLTK 3.10.2 Path Traversal via corpus-reader constructors |
| CVE-2026-79657 | NL nltk nltk | 9.8 | Aug 25 | NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization |
| CVE-2026-78683 | NL nltk nltk | 9.6 | Aug 25 | NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization |
| CVE-2026-78682 | NL nltk nltk | 7.5 | Aug 25 | NLTK before 3.10.3 SSRF Protection Bypass via Proxy |
| CVE-2026-78681 | NL nltk nltk | 7.5 | Aug 25 | NLTK before 3.10.3 Entity Expansion DoS via ElementTree |
| CVE-2026-78680 | NL nltk nltk | 7.8 | Aug 25 | NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary |
| CVE-2026-70626 | NL nltk nltk | 6.2 | Aug 22 | NLTK before 3.9.4 Symlink Escape via CorpusReader |
| CVE-2026-66393 | NL nltk nltk | 7.5 | Aug 22 | NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder |
| CVE-2026-65915 | NL nltk nltk | 6.5 | Aug 22 | NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer |
| CVE-2026-63312 | NL nltk nltk | 7.5 | Aug 22 | NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read |
| CVE-2026-63311 | NL nltk nltk | 5.3 | Aug 22 | NLTK before 3.10.0 SSRF via DNS Resolution Failure |
| CVE-2026-62388 | NL nltk nltk | 7.5 | Aug 22 | NLTK before 3.10.0 Insecure Default Configuration in pathsec.py |
| CVE-2026-62385 | NL nltk nltk | 7.5 | Aug 22 | NLTK 3.9.4 Path Traversal via FrameNet and NKJP Readers |
| CVE-2026-62384 | NL nltk nltk | 7.5 | Aug 22 | NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2 |
| CVE-2026-62383 | NL nltk nltk | 5.5 | Aug 22 | nltk IPIPANCorpusReader Symlink Arbitrary File Read |
| CVE-2026-71514 | NL nltk nltk | 3.3 | Aug 22 | NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass |
| CVE-2026-71513 | NL nltk nltk | 8.8 | Aug 22 | NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass |
| CVE-2026-72818 | NL nltk nltk | 7.5 | Aug 20 | NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input |
| CVE-2026-12372 | NL nltk/nltk nltk | 3.7 | Aug 9 | Server-Side Request Forgery (SSRF) in nltk/nltk |
| CVE-2026-12261 | NL nltk/nltk nltk | 6.5 | Aug 7 | Improper Access Control in nltk/nltk |
| CVE-2026-12259 | NL nltk/nltk nltk | 6.5 | Aug 3 | Improper Input Validation in nltk/nltk |
| CVE-2025-71408 | NL Nltk Nltk | 7.8 | Jul 24 | NLTK < 3.9.3 Eval Injection via collocations.py Command-Line Arguments |
| CVE-2026-12252 | NL nltk/nltk nltk | 7.8 | Jul 4 | Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk |
| CVE-2026-54293 | NL nltk nltk | 7.5 | Jun 22 | NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read |
| CVE-2026-12199 | NL nltk/nltk nltk | 7.5 | Jun 17 | Unauthenticated Denial of Service in nltk.app.wordnet_app |
| CVE-2026-33236 | NL nltk nltk | 8.1 | Mar 20 | NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite |
| CVE-2026-33231 | NL nltk nltk | 7.5 | Mar 20 | NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app |
| CVE-2026-33230 | NL nltk nltk | 6.1 | Mar 20 | nltk Vulnerable to Cross-site Scripting |
| CVE-2026-0846 | NL nltk/nltk nltk | 7.5 | Mar 9 | Arbitrary File Read via Absolute Path Input in nltk.util.filestring() |
| CVE-2026-0848 | NL nltk/nltk nltk | 10.0 | Mar 5 | Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading |
| CVE-2026-0847 | NL nltk/nltk nltk | 7.5 | Mar 4 | Path Traversal in nltk/nltk |
| CVE-2025-14009 | NL nltk/nltk nltk | 8.8 | Feb 18 | Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution |
| CVE-2021-3842 | NL Nltk Nltk | 7.5 | Jan 4 | nltk is vulnerable to Inefficient Regular Expression Complexity |
| CVE-2021-43854 | NL Nltk Nltk | 7.5 | Dec 23 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing |
| CVE-2021-3828 | NL Nltk Nltk | 7.5 | Sep 27 | nltk is vulnerable to Inefficient Regular Expression Complexity |
| CVE-2019-14751 | NL Nltk Nltk | 7.5 | Aug 22 | NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is… |