CVE-2026-126296

NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params

NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126297

NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances

NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126298

NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form

NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126299

NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring

NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126300

NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize

NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126301

NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize

NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126302

NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query

NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox.

CVSS 4.0 · 4.8 Medium EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126303

NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()

NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-103645

Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt

An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.

CVSS 4.0 · 1.1 Low EPSS n/a KEV · Not listed

Vendors

Qt

Products

Qt Qt5compat Qtbase

CVE-2026-126304

NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader

NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-126305

EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments

EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials.

CVSS 4.0 · 8.5 High EPSS n/a KEV · Not listed

Vendors

Espocrm

Products

Espocrm

CVE-2026-126306

EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed

Vendors

Espocrm

Products

Espocrm

CVE-2026-126307

Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws

Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard hostnames to capture login bodies, hijack DDNS profiles, create executable schedules without exec scope, or exhaust memory via buffered NAT requests.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126308

Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps

The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Coder

Products

Coder

CVE-2026-126309

OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import

OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names.

CVSS 4.0 · 7.6 High EPSS n/a KEV · Not listed

Vendors

Openbao

Products

Openbao

CVE-2026-126310

OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials

OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed

Vendors

Openbao

Products

Openbao

CVE-2026-126311

OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates

OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users.

CVSS 4.0 · 4.6 Medium EPSS n/a KEV · Not listed

Vendors

Openbao

Products

Openbao

CVE-2026-126312

OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths

OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules.

CVSS 4.0 · 7.6 High EPSS n/a KEV · Not listed

Vendors

Openbao

Products

Openbao

CVE-2026-126313

Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records

Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126314

Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—