GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
ntlk unsafe deserialization vulnerability
High
CVE-2024-39705
was published
for
nltk
(pip)
Jun 28, 2024
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
High
CVE-2026-54293
was published
for
nltk
(pip)
Jun 16, 2026
Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
High
CVE-2026-12074
was published
for
nltk
(pip)
Jul 31, 2026
Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
High
CVE-2026-12072
was published
for
nltk
(pip)
Jul 31, 2026
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
High
CVE-2026-12061
was published
for
nltk
(pip)
Jul 31, 2026
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
High
CVE-2026-12075
was published
for
nltk
(pip)
Jul 31, 2026
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
Moderate
CVE-2026-63311
was published
for
nltk
(pip)
Sep 2, 2026
ProTip!
Advisories are also available from the
GraphQL API