FreeRDP, NLTK, and Spark security fixes

FreeRDP shipped a point release closing multiple server-side flaws, while NLTK and Apache Spark each addressed a single disclosed vulnerability. Remote desktop, NLP, and big-data operators have concrete updates to evaluate.

FreeRDP 3.31.0 closes five server-side flaws

FreeRDP 3.31.0 fixes five server-side vulnerabilities present through 3.30.0, including a demonstrated pre-authentication remote code execution chain. The affected code paths are used by GNOME and KDE remote desktop embeddings. Operators of those desktop environments should treat the update as high priority.

NLTK patches ReDoS in Text.findall()

NLTK disclosed and fixed CVE-2026-80205, a regular-expression denial-of-service issue in Text.findall() rated CVSS 8.7. The flaw arises from acceptance of unvalidated user-supplied regular expressions. Applications that pass external input to this API need the corrected release to avoid resource exhaustion.

Apache Spark History Server XSS remediated

Apache Spark reported CVE-2026-32773, a cross-site scripting vulnerability in the web UI of the History Server affecting 3.5.4 and earlier builds before 3.5.8. Successful exploitation requires both the ability to launch jobs and a subsequent visit by an administrator. Cluster administrators can close the low-severity issue by moving to the patched series.