picklescan has 52 CVEs on record between 2025 and 2026. Disclosures have slowed: 0 in the last 90 days after 19 in the 90 before. The busiest recent month was June 2026 with 19. The median CVSS is 8.4 (high), with 11 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-502 (15) and CWE-184 (7).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- —
- Last 90 days
- 0 prev 19
Weakness classes
Products
- picklescan 52
Worst active — by depth score
CVE-2025-1716Critical· 9.8picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft …66GHSA-82fg-2r99-h7v6Critical· 10.0Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass55GHSA-g7vj-qw6x-g3p8Critical· 9.8Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist54GHSA-rmpp-8wf5-xx5qCritical· 9.8Duplicate Advisory: Picklescan vulnerable to Arbitrary File Writing54GHSA-j6c9-qvp8-699fCritical· 9.8Duplicate Advisory: picklescan missing detection by simple obfuscation of a `builtins.eval` call54
picklescan vulnerabilities
CVEs affecting picklescan, newest first. Open any entry for full detail, references, and exploit status.
52 CVEsRSS
CVE-2025-71378MediumPicklescan is missing detection when calling built-in Python cProfile.runctx
Picklescan is missing detection when calling built-in Python cProfile.runctx
CVE-2025-71357HighPicklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
CVE-2025-71344MediumPicklescan is missing detection when calling built-in python ensurepip._run_pip
Picklescan is missing detection when calling built-in python ensurepip._run_pip
CVE-2025-71374MediumPicklescan has a missing detection when calling built-in python profile.Profile.run
Picklescan has a missing detection when calling built-in python profile.Profile.run
CVE-2025-71352MediumPicklescan has a missing detection when calling built-in python trace.Trace.runctx
Picklescan has a missing detection when calling built-in python trace.Trace.runctx
CVE-2025-71368MediumPicklescan is missing detection when calling built-in python doctest.debug_script
Picklescan is missing detection when calling built-in python doctest.debug_script
CVE-2025-71371MediumPicklescan has a missing detection when calling built-in python code.InteractiveInterpreter
Picklescan has a missing detection when calling built-in python code.InteractiveInterpreter
CVE-2025-71361MediumPicklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
CVE-2025-71376High· 8.1Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions
CVE-2025-71358MediumPicklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
CVE-2025-71341High· 8.1Picklescan has a missing detection when calling built-in python profile.Profile.runctx
Picklescan has a missing detection when calling built-in python profile.Profile.runctx
CVE-2025-71349MediumPicklescan has a missing detection when calling built-in python trace.Trace.run
Picklescan has a missing detection when calling built-in python trace.Trace.run
CVE-2025-71363MediumPicklescan is missing detection when calling built-in python cProfile.run
Picklescan is missing detection when calling built-in python cProfile.run
CVE-2025-71354MediumPicklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
CVE-2025-71340MediumPicklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
CVE-2025-71370High· 8.1Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper
CVE-2025-71350MediumPicklescan missing detection when calling pytorch function torch.utils.collect_env.run
Picklescan missing detection when calling pytorch function torch.utils.collect_env.run
CVE-2025-71325HighPicklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
CVE-2025-71351MediumPicklescan missing detection when calling built-in python library function timeit.timeit()
Picklescan missing detection when calling built-in python library function timeit.timeit()
CVE-2025-71355MediumPicklescan failed to detect to some unsafe global function in Numpy library
Picklescan failed to detect to some unsafe global function in Numpy library
CVE-2025-46417HighPicklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
CVE-2025-1716Critical· 9.8PoCpicklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft …
picklescan before 0.0.22 only considers standard pickle file extensions in the scope for its vulnerability scan. An attacker could craft a malicious model that uses Pickle and include a malicious pickle file with a non-standard file exte…