NLTK's CCG lexicon parser function fromstring suffers from a quadratic-time CPU denial of service vulnerability when parsing specially crafted wide bracket bodies or long operator chains. This flaw allows an attacker to cause sustained single-threaded CPU exhaustion by providing a few-megabyte lexicon string, leading to significant availability loss. The vulnerability arises from inefficient string slicing operations in pure-Python loops that scale quadratically with input size. No authentication or user interaction is required, and the vulnerability affects versions prior to 3.10.4. A fix is available in version 3.10.4.
NLTK versions up to 3.10.3 contain a quadratic-time CPU denial of service vulnerability in the Tree.chomsky_normal_form method when using the default right-factor binarization. This occurs because the method repeatedly removes the first element of a list using list.pop(0), which is an O(N) operation, causing the overall process to scale quadratically with the number of children in a node. An attacker supplying a wide flat tree can cause significant CPU consumption, leading to denial of service without requiring authentication or user interaction. The issue is fixed in version 3.10.4.
A malicious file identified by the SHA-256 hash 6fbdd13040b4716599a1dca4797b1fbe9b1d1df002ed4ef67147462dd288a39e was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file was detected seven times during attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in the Netherlands. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to identify potential compromise.
A malicious file identified by the SHA-256 hash af3e4ef0c18704fc45dc2276cae6d0010449778066c67c93c1891f62fcd3a54d was observed by OffSeq Mirage honeypot sensors on 2026-11-14. This file was detected three times during attacker activity involving the T1105 technique (Ingress Tool Transfer) from attacker infrastructure located in the Netherlands. The hash corresponds to a malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
NLTK's ConllCorpusReader.srl_instances() method has a quadratic-time CPU denial of service vulnerability when processing semantic-role-labeling (SRL) data from a CoNLL corpus. An attacker can craft a corpus with many predicates and span columns, placing the sole head span in the last column, causing the instance builder to perform excessive nested rescans. This leads to sustained single-threaded CPU exhaustion, resulting in availability loss. The vulnerability affects NLTK versions prior to 3.10.4 and is fixed in version 3.10.4. Exploitation requires the application to process untrusted CoNLL SRL data using the vulnerable API. Confidentiality and integrity are not impacted.
The npm package @zread/cli-win32-arm64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential exposure of all secrets and keys stored on the affected system. Immediate rotation of all secrets and keys from a different, uncompromised computer is strongly advised. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package @zread/cli-win32-x64 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package '@zread/cli-linux-x64' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package @zread/cli-linux-arm64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised device due to the risk of persistent malicious software.
The npm package @zread/cli-darwin-x64 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential exposure of all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a separate, uncompromised machine is strongly advised.
The npm package @zread/cli-darwin-arm64 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
The zread_cli npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
NLTK's BllipParser component in versions 3.10.0 through before 3.10.4 allows an attacker to supply arbitrary filesystem paths to its native C extension without validation. This bypasses NLTK's usual path security checks, enabling reading of arbitrary files outside the intended data directories. The flaw can lead to disclosure of sensitive local files or denial of service by causing the parser to read oversized or special files. A fix is available in version 3.10.4.
A vulnerability in ag-psd versions prior to 31.0.0 allows a crafted PSD file with maliciously declared large dimensions to cause excessive memory allocation. This leads to an out-of-memory condition that can crash the process or exhaust system memory, resulting in a denial-of-service (DoS) condition. The flaw arises because the library allocates memory based on header-declared geometry before validating these values against actual data size. A fix is available in version 31.0.0.
File Browser v2.63.15 has a vulnerability where deleting a shared directory using a path with a trailing slash fails to remove the associated public share. This occurs because the database query for shares uses the unnormalized path, missing the exact share path without the trailing slash. As a result, if the directory is recreated later, the stale public share becomes active again, exposing the new directory contents through the old public URL. The issue affects versions prior to 2.63.17 and is fixed in 2.63.17.
The npm package @jelou/cli-win32-x64 version 4.26.1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
PrestaShop versions before 8.2.9 and 9.2.1 have an authorization bypass vulnerability in multi-shop setups. Authenticated Webservice API key holders can read and modify customer records across shops without proper ownership checks. This flaw allows attackers to access sensitive customer data including password hashes and secure keys, and to change customer emails and passwords, potentially leading to account takeover.
CVE-2026-71531 is an authorization vulnerability in PrestaShop versions before 8.2.9 and 9.2.1 affecting the Webservice API. It allows attackers with a restricted shop key to bypass shop-specific access controls by manipulating the id_shop parameter to access data from all shops. This flaw enables unauthorized reading, modification, or deletion of data across shops, including sensitive customer information such as email addresses, secure keys, and password hashes.
CVE-2026-129180 is a SQL injection vulnerability in projectworlds Visitor Management System version 1.0. The flaw exists in the mysqli_query function within the actionpage.php file, where manipulation of the 'purpose' argument allows remote attackers to execute SQL injection attacks. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been published, but there is no indication of active exploitation in the wild. No patch or remediation information is currently available.
NLTK versions prior to 3.10.4 contain an untrusted search path vulnerability in the nltk.parse.dependencygraph.dot2img function. This function resolves the Graphviz dot executable via the PATH environment variable but does not perform ownership or writability validation on the resolved executable. A local low-privileged attacker with write access to a directory in the victim's PATH can replace or plant a malicious dot executable, leading to code execution when dot2img or DependencyGraph.repr_svg is invoked. This issue is fixed in version 3.10.4.