漏洞公告

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

`nx graph` dev server permissive CORS policy

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

OnionShare Receive mode writes uploaded files even when file uploads are disabled

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings exposes node configuration secrets through egg configuration-file templating

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

dssrf has an SSRF bypass with remove_at_symbol_in_string

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted