Advisory Catalog

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

OnionShare Receive mode writes uploaded files even when file uploads are disabled

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings exposes node configuration secrets through egg configuration-file templating

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

fast-uri vulnerable to host confusion via backslash authority introducer

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()