📄 NLTK XML Parser Weakness Causes Denial of Service
Teams processing untrusted XML through NLTK should upgrade as part of security patching. Prioritize exposed services that accept attacker-controlled XML input.
CVE-2026-78681 affects NLTK versions before 3.10.3, where XML parsing allows entity declarations in DTDs that can create memory-expanding payloads. The vulnerability can cause denial of service and is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
⚠️ node-poppler Flaw Allows Remote Argument Injection
Teams using node-poppler for PDF processing should apply the available patch promptly, especially for internet-facing services. Prioritize deployments that accept remote PDF conversion requests.
CVE-2026-78637 affects Fdawgs node-poppler up to versions 9.1.2/10.0.1, where PDF utility functions in src/index.js are vulnerable to argument injection through manipulation of the file_path parameter. The remotely triggerable issue is rated HIGH with CVSS 7.3.
🔗 Read more 🔗
Source: NVD
🚨 Critical OCPP Buffer Overflow Threatens EV Charging Clients
EV charging vendors and operators using this OCPP client should patch immediately. Treat exposed charging infrastructure as high priority because a malicious central system or man-in-the-middle could trigger the flaw.
CVE-2026-13214 affects the OCPP 1.6 client implementation in subsys/net/lib/ocpp/ocpp_j.c, where parse_getconfig_msg() contains a stack buffer overflow caused by unsafe copying of attacker-controlled JSON data. The vulnerability can cause remote stack corruption and is rated CRITICAL with CVSS 9.8.
🔗 Read more 🔗
Source: NVD
🔑 WordPress InfusedWoo Pro Bug Enables Account Takeover
WordPress administrators running InfusedWoo Pro should update immediately and review accounts for suspicious activity. Sites allowing subscriber-level access should treat this as a high-priority patch.
CVE-2026-19892 affects the InfusedWoo Pro plugin for WordPress through version 5.1.17, where missing capability checks in ajax_iwar_preview_email() allow privilege escalation. Authenticated low-privilege users can obtain password reset links for arbitrary users including administrators, and the issue is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
🐍 NLTK Deserialization Flaw Enables Python Code Execution
Developers using affected NLTK versions should upgrade to 3.10.0 or later quickly. Prioritize applications that load NLP models from untrusted sources.
CVE-2026-78683 affects NLTK before 3.10.0, where unsafe pickle deserialization in TransitionParser.parse() allows attacker-crafted model files to execute arbitrary Python code. The vulnerability is rated CRITICAL with CVSS 9.6.
🔗 Read more 🔗
Source: NVD
🌐 NLTK Proxy Validation Issue Creates SSRF Risk
Applications using NLTK download features behind HTTP proxies should update promptly. Focus first on environments where internal services are reachable from the application network.
CVE-2026-78682 affects NLTK before 3.10.3, where proxy handling in nltk.pathsec.urlopen and related functions can bypass hostname validation and enable server-side request forgery. Attackers may access internal HTTP resources or load forged content, and the issue is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
💻 NLTK Graphviz Path Bug Allows Code Execution
Developers using NLTK visualization features should update quickly, especially where users can influence PATH values or working directories. Restrict untrusted file placement until patching is complete.
CVE-2026-78680 affects NLTK versions before 3.10.3, where unsafe Graphviz dot binary resolution in dependencygraph.dot2img and AlignedSent.repr_svg can allow arbitrary code execution. The vulnerability is rated HIGH with CVSS 7.8.
🔗 Read more 🔗
Source: NVD
📂 GitPython Clone Flaw Enables Filesystem Abuse
Projects using GitPython for repository automation should upgrade promptly. Pay special attention to CI/CD systems that clone attacker-controlled repositories.
CVE-2026-78677 affects GitPython before 3.1.59, where missing handling of –separate-git-dir allows attackers to place repository metadata outside the intended clone destination. The issue can enable arbitrary directory creation and potential hook execution, and is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🔥 Critical GitPython Config Injection Leads to Code Execution
GitPython users should patch immediately and inspect workflows handling untrusted Git configuration files. CI/CD pipelines and automated repository tooling should be prioritized.
CVE-2026-78676 affects GitPython before 3.1.59, where unsafe re-serialization of multi-line git-config values can inject directives such as core.hooksPath. The flaw can enable arbitrary code execution through Git hooks and is rated CRITICAL with CVSS 9.8.
🔗 Read more 🔗
Source: NVD
🗂️ GitPython Bug Exposes Local File Contents
Developers processing external repositories with GitPython should update quickly. Avoid handling untrusted repositories until the patched version is deployed.
CVE-2026-78675 affects GitPython before 3.1.59, where unsafe .gitmodules parsing with merge_includes enabled can disclose local file contents through crafted include directives. The vulnerability is rated HIGH with CVSS 8.4.
🔗 Read more 🔗
Source: NVD
🔒 Grav CMS Twig Sandbox Flaw Exposes Secrets
Grav administrators should upgrade quickly and review accounts with page-edit permissions. Treat sites with config_access enabled as higher priority.
CVE-2026-76846 affects Grav before 2.0.16, where an incomplete Twig sandbox denylist allows users with page-edit permissions to access sensitive configuration values. The vulnerability is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
⚡ Grav Email Plugin Flaw Enables Command Execution
Users of the Grav Email plugin should update immediately and review accounts with page editing permissions. Prioritize systems where authenticated users can modify page content.
CVE-2026-75574 affects the Grav Email plugin before 4.2.2, where page-editor-controlled Email action parameters are rendered as unsandboxed Twig templates. Authenticated users with limited permissions can execute operating-system commands, and the vulnerability is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD