NLTK Project NLTK

Name: NLTK Project NLTK
Brand: NLTK Project

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical11high3medium0low

updated 2026-10-28

vulnerabilities (21)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-14751US	high7.5	5.67% (93rd)	Exploit	no fix	2019-08-22	≤ 3.4.5
CVE-2026-0848US	—	0.79% (56th)	Exploit	no fix	2026-03-05	≤ 3.9.2
CVE-2024-39705US	—	1.35% (71st)	—	no fix	2024-06-27	≤ 3.8.1
CVE-2026-79657US	critical9.8	1.27% (70th)	—	no fix	2026-08-25	≤ 3.10.2
CVE-2025-14009US	—	1.04% (64th)	—	no fix	2026-02-18	≤ 3.9.2
CVE-2026-0847US	high7.5	0.94% (61st)	—	no fix	2026-03-04	≤ 3.9.2
CVE-2026-0846US	high7.5	0.55% (46th)	—	no fix	2026-03-09	≤ 3.9.2
CVE-2026-66393US	high7.5	0.52% (44th)	—	no fix	2026-08-22	≤ 3.9.3
CVE-2026-62388US	high7.5OT elevated	0.51% (44th)	—	no fix	2026-08-22	≤ 3.9.4
CVE-2026-79676US	medium5.9	0.45% (39th)	—	no fix	2026-08-25	≤ 3.10.3
CVE-2026-78682US	high7.5	0.43% (38th)	—	no fix	2026-08-25	≤ 3.10.2
CVE-2026-79674US	high8.2	0.39% (33rd)	—	no fix	2026-08-25	≤ 3.10.2
CVE-2026-81726US	high7.0	0.34% (27th)	—	no fix	2026-08-27	≤ 3.10.3
CVE-2026-63311US	medium5.3	0.33% (27th)	—	no fix	2026-08-22	≤ 3.9.4
CVE-2026-109956US	high7.0	0.32% (25th)	—	no fix	2026-10-13	≤ 3.10.3
CVE-2025-71408US	—	0.27% (18th)	—	no fix	2026-07-24	≤ 3.9.3
CVE-2026-12372US	—	0.26% (18th)	—	no fix	2026-08-09	≤ 3.9.4
CVE-2026-81727US	high7.1	0.19% (8th)	—	no fix	2026-08-27	≤ 3.10.2
CVE-2026-62383US	medium5.5	0.18% (8th)	—	no fix	2026-08-22	3.10.0 → 3.10.2
CVE-2026-78680US	high7.8	0.18% (7th)	—	no fix	2026-08-25	≤ 3.10.3
CVE-2026-12841US	—	—	—	no fix	2026-09-07	≤ 3.10.3

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')7 CVEs
CWE-59Improper Link Resolution Before File Access ('Link Following')4 CVEs
CWE-73External Control of File Name or Path4 CVEs
CWE-918Server-Side Request Forgery (SSRF)3 CVEs
CWE-502Deserialization of Untrusted Data2 CVEs
CWE-1188Initialization of a Resource with an Insecure Default1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-300Channel Accessible by Non-Endpoint1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.