stanford records

9 published records for vendor stanford.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 77.8%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2021-3878No exploit	Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpstanford · corenlp · CWE-611 Pre-auth XXE	Critical9.8	—	1.8%	Oct 15, 2021
39Monitor	CVE-2022-0239No exploit	Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpstanford · corenlp · CWE-611 Pre-auth XXE	Critical9.8	—	1.3%	Jan 17, 2022
39Monitor	CVE-2021-44550No exploit	An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).stanford · corenlp · CWE-74 Pre-auth	Critical9.8	—	1.2%	Feb 24, 2022
39Monitor	CVE-2023-39020No exploit	stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2Pipedstanford · stanford parser · CWE-94 pre-auth RCE	Critical9.8	—	1.0%	Jul 28, 2023
30Monitor	CVE-2013-2106No exploit	webauth before 4.6.1 has authentication credential disclosurestanford · webauth · CWE-522 Pre-auth Info leak	High7.5	—	1.5%	Dec 3, 2019
30Monitor	CVE-2021-3869No exploit	Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpstanford · corenlp · CWE-611 Pre-auth XXE	High7.5	—	1.3%	Oct 19, 2021
30Monitor	CVE-2026-54499No exploit	Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loadersstanford · stanza · CWE-502 pre-auth RCE Deserialization	High7.5	—	0.5%	Jul 8, 2026
28Monitor	CVE-2022-0198No exploit	Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpstanford · corenlp · CWE-611 XXE	High7.1	—	0.7%	Jan 13, 2022
17Monitor	CVE-2009-2945No exploit	weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certastanford · webauth · CWE-255 Pre-auth	Medium4.3	—	0.8%	Sep 15, 2009

CVE-2021-3878
40Plan
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- XXE
stanford · corenlpOct 15, 2021
CVE-2022-0239
39Monitor
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- XXE
stanford · corenlpJan 17, 2022
CVE-2021-44550
39Monitor
An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
stanford · corenlpFeb 24, 2022
CVE-2023-39020
39Monitor
stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2Piped
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
stanford · stanford parserJul 28, 2023
CVE-2013-2106
30Monitor
webauth before 4.6.1 has authentication credential disclosure
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Info leak
stanford · webauthDec 3, 2019
CVE-2021-3869
30Monitor
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- XXE
stanford · corenlpOct 19, 2021
CVE-2026-54499
30Monitor
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Deserialization
stanford · stanzaJul 8, 2026
CVE-2022-0198
28Monitor
Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp
HighCVSS 7.1No exploitEPSS 0%
- XXE
stanford · corenlpJan 13, 2022
CVE-2009-2945
17Monitor
weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certa
MediumCVSS 4.3No exploitEPSS 0%
- Pre-auth
stanford · webauthSep 15, 2009