High
CVE-2026-22609
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 18
Reset filters
High
CVE-2026-22606
Fickling has a bypass via runpy.run_path() and runpy.run_module()
High
CVE-2026-22607
Fickling Blocklist Bypass: cProfile.run()
High
CVE-2026-22608
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
High
CVE-2026-22612
Fickling vulnerable to detection bypass due to "builtins" blindness
High
CVE-2025-71322
Picklescan Bypasses Unsafe Globals Check using pty.spawn
High
CVE-2025-67747
Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list
Critical
CVE-2026-14535
In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless o
High
CVE-2026-14534
Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because the
Medium
ghsa-5cxw-w2xg-2m8h
fickling's `platform` module subprocess invocation evades `check_safety()` with `LIKELY_SAFE`
Medium
ghsa-r48f-3986-4f9c
fickling modules linecache, difflib and gc are missing from the unsafe modules blocklist
High
ghsa-5hwf-rc88-82xm
Fickling missing RCE-capable modules in UNSAFE_IMPORTS
High
ghsa-wccx-j62j-r448
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
Critical
CVE-2026-3490
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
Medium
ghsa-mhc9-48gj-9gp3
Fickling has safety check bypass via REDUCE+BUILD opcode sequence
High
ghsa-mxhj-88fx-4pcv
Fickling: OBJ opcode call invisibility bypasses all safety checks
Low
ghsa-83pf-v6qq-pwmr
Fickling has a detection bypass via stdlib network-protocol constructors
High
CVE-2025-67748
Fickling has Code Injection vulnerability via pty.spawn()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.