stanford vulnerabilities

Products

• corenlp 5
• webauth 2
• stanford parser 1
• stanza 1

Latest stanford CVEs

Newest publication first

1. CVE-2026-54499 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

   Published 2026-07-08

   High·CVSS 7.5 EPSS 0.52%

   Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch...

2. CVE-2023-39020 Code injection in stanford-parser

   Published 2023-07-28

   Critical·CVSS 9.8 EPSS 1.0%

   stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.

3. CVE-2021-44550 Access Control vulnerability within CoreNLP

   Published 2022-02-23

   Critical·CVSS 9.8 EPSS 1.3%

   An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).

4. CVE-2022-0239 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

   Published 2022-01-17

   Critical·CVSS 9.8 EPSS 1.3%

   corenlp is vulnerable to Improper Restriction of XML External Entity Reference

5. CVE-2022-0198 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

   Published 2022-01-13

   High·CVSS 7.1 EPSS 0.76%

   corenlp is vulnerable to Improper Restriction of XML External Entity Reference

6. CVE-2021-3869 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

   Published 2021-10-19

   High·CVSS 7.5 EPSS 1.4%

   corenlp is vulnerable to Improper Restriction of XML External Entity Reference

7. CVE-2021-3878 Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

   Published 2021-10-15

   Critical·CVSS 9.8 EPSS 1.9%

   corenlp is vulnerable to Improper Restriction of XML External Entity Reference

8. CVE-2013-2106 webauth before 4.6.1 has authentication credential disclosure

   Published 2019-12-03

   High·CVSS 7.5 EPSS 1.6%

   webauth before 4.6.1 has authentication credential disclosure

9. CVE-2009-2945 weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a...

   Published 2009-09-15

   Medium·CVSS 4.3 EPSS 0.87%

   weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.