en
NLTK, the Natural Language Toolkit, is a free, open-source Python project for natural language processing. It provides libraries and interfaces for language data and common NLP tasks, including tokenization, stemming, tagging, parsing, classification, and semantic analysis.
As of 10/22/2026, nltk recorded 32 security vulnerabilities in the last 90 days across 2 products, including 22 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, nltk had the most security vulnerabilities in the nltk ecosystem, with 29 vulnerabilities—approximately 90.63% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109956NLTK through 3.10.3 Path Traversal via WekaClassifier Model PathCVE-2026-81727NLTK before 3.10.3 Hardlink File Overwrite via downloaderCVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIsCVE-2026-81725NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReaderCVE-2026-81724NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-109956NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path | Exploitation statusNot confirmed | FixYes | Affected productnltk | Published10/13/2026 | SeverityHigh |
CVE-2026-81727NLTK before 3.10.3 Hardlink File Overwrite via downloader | Exploitation statusActively exploited | FixYes | Affected productnltk | Published08/27/2026 | |
CVE-2026-81726NLTK through 3.10.3 Path Traversal via Model-Artifact APIs | Exploitation statusActively exploited | FixYes | Affected productnltk | Published08/27/2026 | |
CVE-2026-81725NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader | Exploitation statusNot exploited | FixYes | Affected productnltk | Published | |
CVE-2026-81724NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion | Exploitation statusActively exploited | FixYes | Affected productnltk | Published08/27/2026 | |
CVE-2026-81723NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView | Exploitation statusActively exploited | FixYes | Affected productnltk | Published08/27/2026 | |
CVE-2026-81722nltk PorterStemmer before 3.10.3 Quadratic-time DoS | Exploitation statusActively exploited | FixYes | Affected productnltk | Published08/27/2026 | |
CVE-2026-80206NLTK 3.10.2 Regular Expression Denial of Service via tgrep | Exploitation statusActively exploited | FixYes | Affected productnltk | Published08/26/2026 | |
CVE-2026-80205NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex | Exploitation statusNot exploited | FixYes | Affected productnltk | Published08/26/2026 | |
CVE-2026-79676NLTK before 3.10.3 Path Traversal via Symlink Bypass | Exploitation statusActively exploited | FixYes | Affected productnltk | Published08/25/2026 |
50 Results | Page 1 of 5
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |
| SeverityHigh |
| SeverityHigh |
| SeverityHigh |