CVE-2025-71351

CVE-2025-71351 affects picklescan prior to version 0.0.25. The vulnerability arises because timeit.timeit() calls used in the reduce method are not detected by the tool, allowing crafted pickle payloads to bypass detection and trigger remote code execution when pickle.load() is performed. Attacke...

EUVD-2025-210292

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit in the reduce method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute...

CVE-2025-71351 picklescan - Remote Code Execution via timeit.timeit() Detection Bypass

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit in the reduce method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbitrary system commands, which evade picklescan detection and execute...

CVE-2025-71348

CVE-2025-71348 affects the picklescan utility (pre-0.0.28) where malicious pickle payloads can invoke torch.utils._config_module.load_config during unpickling, bypassing detection and enabling remote code execution in supply-chain contexts. Documents describe a bypass in reduce methods that allow...

MINI-XVMH-XPQG-J3P2

Bulletin has no description...

MINI-FFVJ-X865-HJH4

Bulletin has no description...

MINI-RVFR-3X3G-W9W3

Bulletin has no description...

CVE-2026-12788

A vulnerability was determined in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /adpweb/a/base/barcodeDetail/import of the component XML Parser. This manipulation causes xml external entity reference. It is possible to...

Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console. id: CVE-2019-7276 info: name: Optergy Proton/Enterprise - Unauthenticated RCE via Backdoor Console author: daffainfo severity: critical description: | Optergy Proton/Enterprise devices allow Remote Root Cod...

CGA-7QJR-X2VG-CHX3

Bulletin has no description...

CGA-5X4F-FPCQ-MC9M

Bulletin has no description...

CGA-5RF3-F5P3-G7P3

Bulletin has no description...

PT-2026-51230

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.5.0 through 5.9.13 Description An issue exists in the FieldsController::actionRenderCardPreview method where the fieldLayoutConfig POST parameter is passed directly to Fields::createLayout without being processed by...

PT-2026-51236

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.1 Description SiYuan fails to sanitize package metadata and README content within the Bazaar marketplace. This allows malicious authors to inject arbitrary HTML and JavaScript into the displayName, description, or...

PT-2026-51215

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.25 Description The software fails to detect malicious pickle files that utilize the timeit.timeit function within the reduce method. This allows for remote code execution, as attackers can craft pickle files th...

PT-2026-51214

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.28 Description An issue exists where the software fails to detect malicious pickle files that invoke the load config function within the torch.utils. config module module inside reduce methods. This allows...

PT-2026-51217

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.30 Description The software fails to detect cProfile.runctx function calls within pickle file reduce methods. This allows attackers to bypass detection and execute arbitrary code when malicious pickle files are...

Malicious code in requests-enhancer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f61f1a905e0ec1bb593f7b20d4f9a8a9e72deeb16440f72acbcaf00aeab1cd On import requestsenhancer, the package's init.py spawns a daemon thread that runs pip install...

CGA-6XC8-HW7R-5CQW

Bulletin has no description...

CGA-2RP4-X4W5-V2X2

Bulletin has no description...