Deserialization of Untrusted Data

Overview pyfury is an Apache Fury™incubating is a blazingly fast multi-language serialization framework powered by jit and zero-copy Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the pickle module. An attacker can execute arbitrary code by crafting a da...

CVE-2025-10974 giantspatula SewKinect Endpoint calculate pickle.loads deserialization

A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /calculate of the component Endpoint. Such manipulation of the argument bodyparts/pointcloud leads to deserialization. The attack may be...

CVE-2025-10974 giantspatula SewKinect Endpoint calculate pickle.loads deserialization

A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /calculate of the component Endpoint. Such manipulation of the argument bodyparts/pointcloud leads to deserialization. The attack may be...

Insecure Deserialization

picklescan is vulnerable to insecure deserialization. The vulnerability is due to using the getentity function to execute a remote pickle file, which allows an attacker to run arbitrary code...

Remote Code Execution (RCE)

picklescan is vulnerable to Remote Code Execution RCE.The vulnerability is due to insecure handling of pickle deserialization where the function can execute attacker-controlled reduce payloads and unsafe validation, which allows an attacker to achieve remote code execution by supplying a maliciou...

vulnerable-python-poc-exploit

Отчет по анализу уязвимостей Python приложения vulnerable...

SUSE CVE-2025-58367

DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution via...

Monai: Unsafe use of Pickle deserialization may lead to RCE

To prevent this report from being deemed inapplicable or out of scope, due to the project's unique nature for medical applications and widespread popularity 6k+ stars, it's important to pay attention to some of the project's inherent security issues. This is because medical professionals may not...

GHSA-P8CM-MM2V-GWJM Monai: Unsafe use of Pickle deserialization may lead to RCE

To prevent this report from being deemed inapplicable or out of scope, due to the project's unique nature for medical applications and widespread popularity 6k+ stars, it's important to pay attention to some of the project's inherent security issues. This is because medical professionals may not...

PYSEC-2025-142

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

CVE-2025-58757

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

PYSEC-2025-142

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

CVE-2025-58757 MONAI's unsafe use of Pickle deserialization may lead to RCE

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

CVE-2025-58757 MONAI's unsafe use of Pickle deserialization may lead to RCE

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

CVE-2025-58757

MONAI 1.5.0 and earlier are affected by an unsafe deserialization vulnerability in monai/data/utils.py: pickle_operations deserializes dictionary values with a specific suffix using pickle.loads() without validation, enabling arbitrary code execution. The CVE describes potential RCE confirmed by ...

CVE-2025-58757 MONAI's unsafe use of Pickle deserialization may lead to RCE

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

PT-2025-36533

Name of the Vulnerable Software and Affected Versions: MONAI versions up to and including 1.5.0 Description: MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The pickle operations function in monai/data/utils.py automatically handles dictionary key-value pairs ending wi...

CVE-2025-58367

DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution via...

CVE-2025-58367

CVE-2025-58367 affects the Python package DeepDiff (versions 5.0.0–8.6.0). The vulnerability arises from class pollution in the Delta class constructor and a gadget in DeltaDiff that lets an attacker modify deepdiff.serialization.SAFE_TO_IMPORT to permit dangerous classes (e.g., posix.system), en...

CVE-2025-58367 DeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollution

DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnerable to class pollution via the Delta class constructor, and when combined with a gadget available in DeltaDiff, it can lead to Denial of Service and Remote Code Execution via...