https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T19:21:39.372327+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-61622 CVE-2025-61622 — Apache Fory, Apache Fory: Python RCE via unguarded pickle fallback serializer in pyfory 2026-10-08T19:21:39.374419+00:00

Affected: Apache Software Foundation Apache Fory

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.

Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.

 https://cve.radiocsirt.org/vuln/ghsa-538v-3wq9-4h3r GHSA-538v-3wq9-4h3r — Apache Pyfory python is vulnerable to deserialization of untrusted data 2026-10-08T19:21:39.374516+00:00

Affected: PyPI: pyfory, PyPI: pyfury

Deserialization of untrusted data in python in pyfory versions 0.12.0 through 0.12.2, or the legacy pyfury versions from 0.1.0 through 0.10.3: allows arbitrary code execution. An application is vulnerable if it reads pyfory serialized data from untrusted sources. An attacker can craft a data stream that selects pickle-fallback serializer during deserialization, leading to the execution of `pickle.loads`, which is vulnerable to remote code execution.

Users are recommended to upgrade to pyfory version 0.12.3 or later, which has removed pickle fallback serializer and thus fixes this issue.