CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 13/03/2026 |
| GHSA-r48f-3986-4f9c | MEDIUM | fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist | 13/03/2026 |
| GHSA-5hwf-rc88-82xm | HIGH | Fickling missing RCE-capable modules in UNSAFE_IMPORTS | 04/03/2026 |
| GHSA-wccx-j62j-r448 | HIGH | Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked | 04/03/2026 |
| GHSA-mhc9-48gj-9gp3 | MEDIUM | Fickling has safety check bypass via REDUCE+BUILD opcode sequence | 25/02/2026 |
| GHSA-mxhj-88fx-4pcv | HIGH | Fickling: OBJ opcode call invisibility bypasses all safety checks | 24/02/2026 |
| GHSA-83pf-v6qq-pwmr | LOW | Fickling has a detection bypass via stdlib network-protocol constructors | 20/02/2026 |
| CVE-2026-22612 | HIGH7.8 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7. | 10/01/2026 |
| CVE-2026-22609 | HIGH7.8 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing | 10/01/2026 |
| CVE-2026-22608 | HIGH7.8 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LI | 10/01/2026 |
| CVE-2026-22607 | HIGH7.8 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Because of this, a malicious pickle that uses cProfile.run() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling's output to decid | 10/01/2026 |
| CVE-2026-22606 | HIGH7.8 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicious pickle that uses runpy.run_path() or runpy.run_module() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickl | 10/01/2026 |
| CVE-2025-67748 | HIGH7.8 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module imports. This led to unsafe pickles based on `pty.spawn()` being incorrectly flagged as `LIKELY_SAFE`, and was fixed in version 0.1.6. This impacted any user or | 16/12/2025 |
| CVE-2025-67747 | HIGH7.8 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module imports. Fickling started blocking both modules to address this issue. This allows an attacker to craft a malicious pickle file that can bypass fickling since it m | 16/12/2025 |