https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-71378.htmlhttps://patchthecve.com/cve/CVE-2025-71378.htmlMon, 12 Oct 2026 22:10:00 +0000HIGH 8.1: picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().https://patchthecve.com/cve/CVE-2025-71357.htmlhttps://patchthecve.com/cve/CVE-2025-71357.htmlMon, 12 Oct 2026 22:10:00 +0000HIGH 8.1: picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.https://patchthecve.com/cve/CVE-2025-71348.htmlhttps://patchthecve.com/cve/CVE-2025-71348.htmlMon, 12 Oct 2026 22:10:00 +0000HIGH 8.1: picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supplyhttps://patchthecve.com/cve/CVE-2026-56304.htmlhttps://patchthecve.com/cve/CVE-2026-56304.htmlWed, 24 Jun 2026 19:17:13 +0000MEDIUM 6.5: picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create loc