Common Vulnerabilities and Exposures (CVE)

CVE-2025-71366

Jul 4, 2026 01:23:38 UTC

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achiev...

CVE-2025-71364

Jul 4, 2026 01:23:37 UTC

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function ...

CVE-2025-71362

Jul 4, 2026 01:23:37 UTC

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

CVE-2025-71360

Jul 4, 2026 01:23:36 UTC

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

CVE-2025-71359

Jul 4, 2026 01:23:35 UTC

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades ...

CVE-2025-71356

Jul 4, 2026 01:23:35 UTC

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when ...

CVE-2025-71353

Jul 4, 2026 01:23:34 UTC

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can craft pickle files with embedded code that evades picklescan detection and executes...

CVE-2025-71347

Jul 4, 2026 01:23:33 UTC

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypass security checks. Remote attackers can embed undetected code in pickle files th...

CVE-2025-71345

Jul 4, 2026 01:23:33 UTC

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed undetected code in pickle files that executes during deserialization, enabling remot...

CVE-2025-71343

Jul 4, 2026 01:23:32 UTC

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection bu...

CVE-2025-71342

Jul 4, 2026 01:23:31 UTC

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in P...

CVE-2026-12252

Jul 4, 2026 00:58:58 UTC

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. Th...

CVE-2026-54424

Jul 4, 2026 00:45:24 UTC

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A u...

CVE-2026-14617

Jul 3, 2026 21:45:10 UTC

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag F...

CVE-2026-58523

Jul 3, 2026 21:26:27 UTC

Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.