CVE-2026-56304

MediumCVSS 6.5/10Last modified Jun 24, 2026

Description

picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payloads to bypass RCE blocklists and create lock files or other filesystem artifacts, potentially causing denial of service or application disruption.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2026
Last modified: Jun 24, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-563058.3Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user p CVE-2026-563066.4Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcemen CVE-2026-563074.3Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path th CVE-2026-563087.3Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing emai CVE-2026-563095.4Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to crea CVE-2026-56317.3A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend CVE-2026-563104.3Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API CVE-2026-563115.3Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.get_current_plan_max_org RPC function that allows unauthe CVE-2026-563126.5Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before capt CVE-2026-563138.1Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise admi CVE-2026-563147.1Capgo before 12.128.12 fails to filter deleted app versions when joining channels during /updates resolution, allowing deleted bundles to re CVE-2026-563159.8picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.p