Priority LOW 37
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00597 · Published 2026-11-03 · Fixed in 1.15.0 CWE-502
Priority HIGH 69
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00405 · Published 2026-09-16 · Fixed in 1.14.0 CWE-22
Priority HIGH 68
Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.00519 · Published 2026-07-08 · Partial fix · 1.12.2 CWE-502
Priority HIGH 82
stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0104 · Published 2023-07-28 · Fixed in 4.5.5 CWE-94
Priority MEDIUM 45
An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01294 · Published 2022-02-23 · Fixed in 4.4.0 CWE-74
Priority HIGH 82
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01217 · Published 2022-01-17 · Fixed in 4.3.3, 4.4.0 CWE-611
Priority LOW 33
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00763 · Published 2022-01-13 · Fixed in 4.3.3 CWE-611
Priority LOW 36
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0136 · Published 2021-10-19 · Fixed in 4.3.1 CWE-611
Priority MEDIUM 46
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01886 · Published 2021-10-15 · Fixed in 4.3.1 CWE-611
Priority LOW 36
webauth before 4.6.1 has authentication credential disclosure
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01576 · Published 2019-12-03 · No fix listed CWE-522
Priority LOW 22
weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.00865 · Published 2009-09-15 · No fix listed CWE-255
THREATIST.IORead the docs