Security advisories

high2026-09-08

CVE-2026-69222-LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

View chart →

harttle/liquidjs · GHSA-4r6h-5v86-94p3

medium2026-09-08

CVE-2026-73262-Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

View chart →

prowler-cloud/prowler · GHSA-c2jg-2778-ggm4

medium2026-09-08

CVE-2026-85063-node-csv: Prototype replacement still reachable via columns path

View chart →

adaltas/node-csv · GHSA-8cw4-87c7-c6xx

medium2026-09-08

CVE-2026-72925-SWC HTML minifier may allow script element breakout when minifying embedded JSON

View chart →

swc-project/swc · GHSA-5qr2-v392-m9g8

critical2026-09-08

CVE-2026-73294-Semaphore U: OS Command Injection

View chart →

semaphoreui/semaphore · GHSA-xp7j-h7jc-4w8p

critical2026-09-08

CVE-2026-60004-Gitea: Remote Code Execution via diffpatch Git Hook Installation

View chart →

go-gitea/gitea · GHSA-rcr6-4jqh-j84m

high2026-09-08

CVE-2026-72789-SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

View chart →

siyuan-note/siyuan · GHSA-v684-q882-jgmq

medium2026-09-08

CVE-2026-72790-SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

View chart →

siyuan-note/siyuan · GHSA-74pj-6g7r-j55c

medium2026-09-08

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

View chart →

siyuan-note/siyuan · GHSA-57v5-wqx3-cgj4

high2026-09-08

CVE-2026-79674-NLTK: Corpus Reader Sandbox Bypass

View chart →

nltk/nltk · GHSA-3gq4-3j92-5w49

high2026-09-08

CVE-2026-79676-NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

View chart →

nltk/nltk · GHSA-p4rw-rvv2-7xwr

critical2026-09-08

CVE-2026-79657-NLTK: Allowlisted pickle loaders still permit code execution in current source

View chart →

nltk/nltk · GHSA-x99w-6fgc-pmfw

high2026-09-08

CVE-2026-78681-NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

View chart →

nltk/nltk · GHSA-97qj-x29f-37w7

high2026-09-08

CVE-2026-78682-NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

View chart →

nltk/nltk · GHSA-6ww7-3frv-cqxh

critical2026-09-08

CVE-2026-78683-NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

View chart →

nltk/nltk · GHSA-rhp5-r9x4-f5g2

medium2026-09-08

CVE-2026-62383-NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

View chart →

nltk/nltk · GHSA-3hhw-38pf-pxj6

high2026-09-08

CVE-2026-62384-NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

View chart →

nltk/nltk · GHSA-f833-7jw8-xwrv

high2026-09-08

CVE-2026-62385-NLTK: Stable FrameNet and NKJP readers parse outside-root XML

View chart →

nltk/nltk · GHSA-568f-pv23-39p4

medium2026-09-08

CVE-2026-12259-NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

View chart →

nltk/nltk · GHSA-5wp5-5229-5g6q

high2026-09-08

CVE-2026-63312-NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

View chart →

nltk/nltk · GHSA-x5ph-mj9p-rfr8