{"vulnerability": "CVE-2026-7967", "sightings": [{"uuid": "bb3abca1-c912-4a35-9845-bbebdc3ab859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7967", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260507", "content": "", "creation_timestamp": "2026-05-06T18:00:00.000000Z"}, {"uuid": "1a0a4498-6702-49ce-8e30-21a10ed0ec34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7967", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260508", "content": "", "creation_timestamp": "2026-05-07T18:00:00.000000Z"}, {"uuid": "bcba8dac-4fae-45b2-a8a6-5c7174f67859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtwc7qg74h2u", "content": "\ud83d\udd34 CVE-2026-79675 - Critical (9.8)\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-79675/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-25T17:00:50.364075Z"}, {"uuid": "c985d7d0-f747-4219-a179-dd8f1bd0a013", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtwfz2x7pl2e", "content": "\ud83d\udea8 CVE-2026-79675 \u2014 CVSS 9.3 CRITICAL\n\nNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java(...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-79675\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-25T18:08:40.661425Z"}, {"uuid": "084622ef-8a18-4838-89fb-5ea826aa91a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwv6e4khx2u", "content": "CVE-2026-79675 - nltk\nVersions of the NLTK Python library before the latest release let attackers add dangerous Java settings when calling its java() function. This can let an attacker run arbitrary code on the system.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nltk #CVE #infosec", "creation_timestamp": "2026-08-25T22:40:04.523073Z"}, {"uuid": "d9d059d3-6aaf-4bc9-85f6-afa1281c3fc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79672", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/76tf32gvk7ijy", "content": "CVE-2026-79672 - Ech0 before 4.4.3 Authentication Bypass via Comment Panel\nCVE ID : CVE-2026-79672\n \n Published : Aug. 25, 2026, 11:33 a.m. | 32\u00a0minutes ago\n \n Description : Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, all...", "creation_timestamp": "2026-08-25T12:14:44.082000Z"}, {"uuid": "46f0a918-76eb-461b-b628-1abce1e06cd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79671", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5gnu35b4glaqj", "content": "CVE-2026-79671 - Ech0 before 4.4.3 SSRF via DNS Resolution Bypass\nCVE ID : CVE-2026-79671\n \n Published : Aug. 25, 2026, 11:33 a.m. | 32\u00a0minutes ago\n \n Description : Ech0 through 4.2.1 contains a server-side request forgery vulnerability in the validateWebhookURL function (webh...", "creation_timestamp": "2026-08-25T12:20:43.764061Z"}, {"uuid": "214a7e0a-315c-485e-99a5-504b1e9e31da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79673", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2l4j6g7r63ht2", "content": "CVE-2026-79673 - Ech0 before 4.4.3 Scope Bypass via profile:read Token\nCVE ID : CVE-2026-79673\n \n Published : Aug. 25, 2026, 11:33 a.m. | 32\u00a0minutes ago\n \n Description : Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allow...", "creation_timestamp": "2026-08-25T12:26:43.832774Z"}, {"uuid": "866c4d07-41c8-4d53-8d99-b09a9dd14eac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu3s6zgslc2f", "content": "CVE-2026-79675 - nltk\nVersions of the NLTK Python library older than 3.10.3 do not check the extra Java settings that can be supplied to its java() helper. An attacker who can influence those settings\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nltk #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-27T21:30:04.160297Z"}, {"uuid": "93ec65a4-1f46-4d7c-b5e4-daafa418774e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79674", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muhbppijgh2f", "content": "\ud83d\udccc CVE-2026-79674 - NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the ... https://www.cyberhub.blog/cves/CVE-2026-79674", "creation_timestamp": "2026-09-01T11:07:07.638219Z"}, {"uuid": "fdddf6c1-8a1b-4b38-95c3-5a7f20b5e061", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79676", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muhu5rfqm52l", "content": "\ud83d\udccc CVE-2026-79676 - NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of n... https://www.cyberhub.blog/cves/CVE-2026-79676", "creation_timestamp": "2026-09-01T16:37:07.507485Z"}, {"uuid": "0200f4cc-d2fd-4192-a2a8-6cd22d4a231a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79675", "type": "seen", "source": "https://gist.github.com/alon710/d77c44365a5d967f73ae86db10f23480", "content": "# CVE-2026-79675: CVE-2026-79675: JVM Argument Injection in Natural Language Toolkit (NLTK) Stanford Wrappers\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-79675\n\n## Summary\nCVE-2026-79675 is a critical command injection vulnerability in NLTK versions prior to 3.10.3 that permits remote attackers to execute arbitrary code on the hosting system. This vulnerability stems from an incomplete mitigation of a previous vulnerability, CVE-2026-12841. While NLTK verified global JVM options configured through the library's setup routines, it failed to perform equivalent safety checks on options provided during per-call invocations of Stanford NLP Java wrappers. Attackers controlling these parameters can pass dangerous Java configuration options to the system shell, bypassing security boundaries to spawn interactive processes or load untrusted Java archives.\n\n## TL;DR\nAn input validation bypass in NLTK's Stanford Java interface allows remote attackers to inject arbitrary JVM command-line options, such as -XX:OnError, to execute system commands and achieve unauthenticated remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00403 (Percentile: 33.49%)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- NLTK (Natural Language Toolkit) versions prior to 3.10.3\n- **NLTK (Natural Language Toolkit)**: < 3.10.3 (Fixed in: `3.10.3`)\n\n## Mitigation\n\n- Upgrade NLTK to version 3.10.3 or higher.\n- Sanitize application parameters to prevent untrusted inputs from reaching the options configuration in NLTK wrappers.\n- Run the application process with reduced OS-level privileges to limit the impact of command execution.\n\n**Remediation Steps:**\n1. Execute the update utility: pip install --upgrade nltk>=3.10.3\n2. Audit existing codebase for usage of StanfordParser, StanfordTokenizer, StanfordPOSTagger, or StanfordSegmenter.\n3. Verify that no client-controlled parameters map directly or indirectly to the java_options argument of these wrapper objects.\n4. Ensure that any usage of the new trusted_raw_options parameter is strictly configured with static, developer-defined strings.\n\n## References\n\n- [NLTK Security Advisory](https://github.com/nltk/nltk/security/advisories/GHSA-m4rf-3fr8-xwx3)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/nltk-before-jvm-argument-injection-via-per-call-options)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-79675) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T21:31:43.242912Z"}, {"uuid": "b8f4bd57-b98b-45e7-b8cc-88acf65bc8b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-79674", "type": "published-proof-of-concept", "source": "https://github.com/nltk/nltk/security/advisories/GHSA-3gq4-3j92-5w49", "content": "", "creation_timestamp": "2026-09-08T18:35:17.185996Z"}]}