CVE-2026-22608 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning tools like picklescan do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still...

Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Fickling's assessment pydoc and ctypes were added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1. Original report Summary Both ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools like...

GHSA-5HVC-6WX8-MVV4 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

Fickling's assessment pydoc and ctypes were added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1. Original report Summary Both ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools like...

Realworld-for-Application_FUGIO_FirstFrameworkFuzzingDetectPOI

FUGIO Production Guide Introduction FUGIO is the firs...

CVE-2018-21079

An issue was discovered on Samsung mobile devices with L5.x, M6.0, N7.x, and O8.0 software. There is a kernel pointer leak in the USB gadget driver. The Samsung ID is SVE-2017-10993 March 2018...

CVE-2023-45315

Improper initialization in some IntelR Power Gadget software for Windwos all versions may allow an authenticated user to potentially enable denial of service via local access...

CVE-2023-45846

Incomplete cleanup in IntelR Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of service via local access...

CVE-2023-45217

Improper access control in IntelR Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-40070

Improper access control in some IntelR Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access...

Siemens Ruggedcom ROX Classic Buffer Overflow (CVE-2022-48948)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Prevent buffer overflow in setup handler Setup function uvcfunctionsetup permits control transfer requests with up to 64 bytes of payload UVCMAXREQUESTSIZE, data stage handler for OUT transfer uses memcpy to cop...

CVE-2026-22187

Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files .bfmemo during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000455)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000455 advisory. gadgetdevdescUDCstore in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal...

Linux Distros Unpatched Vulnerability : CVE-2022-50876

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: musb: Fix musbgadget.c rxstate overflow bug The usb function device call musbgadgetqueue adds the passed request to musbep::reqlist,If the request-length...

SUSE CVE-2022-50876

In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix musbgadget.c rxstate overflow bug The usb function device call musbgadgetqueue adds the passed request to musbep::reqlist,If the request-length musbep-packetsz and isbuffermappedreq return false,the rxstate will co...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992790)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992790 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix deadlock when using NCM gadget The cdns3 driver has the same NCM deadlock as fixe...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992993 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: don't let userspace block driver unbind In the unbind callback for fuac1 and...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992791)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992791 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer check in astvhubinitdev The variable d-name, returned by...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993039)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993039 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: change place of 'privep' assignment in cdns3gadgetepdequeue, cdns3gadgetepenable If...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992746)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992746 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is...

Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef

Summary Picklescan uses the numpy.f2py.crackfortran.getlincoef function a NumPy F2PY helper to execute arbitrary Python code during unpickling. Details Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran.getlincoef in reduce, allowing arbitrary command...