CVE-2026-12372 | Low | 3.7 | 2026-08-09 | A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()`… |
CVE-2026-12261 | Medium | 5.3 | 2026-08-07 | A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package arch… |
CVE-2026-12259 | Medium | 5.3 | 2026-08-03 | In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforc… |
CVE-2025-71408 | High | 7.8 | 2026-07-24 | NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who contr… |
CVE-2026-12252 | High | 7.8 | 2026-07-04 | In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and S… |
CVE-2026-12243 | High | 7.5 | 2026-06-30 | NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.p… |
CVE-2026-54293 | High | 7.5 | 2026-06-22 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2026-12199 | High | 7.5 | 2026-06-17 | A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in i… |
CVE-2026-33236 | High | 8.1 | 2026-03-20 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2026-33231 | High | 7.5 | 2026-03-20 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2026-33230 | Medium | 6.1 | 2026-03-20 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2026-0846 | High | 7.5 | 2026-03-09 | A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input p… |
CVE-2026-0848 | Critical | 10.0 | 2026-03-05 | NLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamically loads… |
CVE-2026-0847 | High | 7.5 | 2026-03-04 | A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCo… |
CVE-2025-14009 | High | 8.8 | 2026-02-18 | A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipf… |
CVE-2021-3842 | High | 7.5 | 2022-01-04 | nltk is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-43854 | High | 7.5 | 2021-12-23 | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Proc… |
CVE-2021-3828 | High | 7.5 | 2021-09-27 | nltk is vulnerable to Inefficient Regular Expression Complexity |
CVE-2019-14751 | High | 7.5 | 2019-08-22 | NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (… |