https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:52:02.396468+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-31395 cnvd-2025-31395 2026-10-08T14:52:02.401968+00:00 cnvd-2025-31395 https://cve.radiocsirt.org/vuln/euvd-2026-260069 EUVD-2026-260069 2026-10-08T14:52:02.402006+00:00 EUVD-2026-260069 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61622 fkie_cve-2025-61622 2026-10-08T14:52:02.402020+00:00

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.

Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.

 https://cve.radiocsirt.org/vuln/ghsa-538v-3wq9-4h3r GHSA-538v-3wq9-4h3r — Apache Pyfory python is vulnerable to deserialization of untrusted data 2026-10-08T14:52:02.402054+00:00

Affected: PyPI: pyfory, PyPI: pyfury

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.

Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.

 https://cve.radiocsirt.org/vuln/pysec-2026-490 PYSEC-2026-490 — Apache Pyfory python is vulnerable to deserialization of untrusted data 2026-10-08T14:52:02.402081+00:00

Affected: PyPI: pyfory

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.

Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.