Ttrailofbits

Products

Exploited and recent CVEs

• CVE-2026-118938 High 8.8 Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis 0.5%
• CVE-2026-16760 High 8.8 Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables 0.5%
• CVE-2026-14535 High 8.8 Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code() 0.6%
• CVE-2026-14534 High 8.8 Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit) 0.6%
• CVE-2026-33753 Medium 6.2 Improper Certificate Validation in rfc3161-client 0.2%
• CVE-2026-22612 High 8.9 Fickling vulnerable to detection bypass due to "builtins" blindness 0.3%
• CVE-2026-22609 High 8.9 Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist 0.6%
• CVE-2026-22608 High 8.9 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection 0.4%
• CVE-2026-22607 High 8.9 Fickling Blocklist Bypass: cProfile.run() 0.5%
• CVE-2026-22606 High 8.9 Fickling has a bypass via runpy.run_path() and runpy.run_module() 0.5%
• CVE-2025-67748 High 7.1 Fickling has Code Injection vulnerability via pty.spawn() 0.3%
• CVE-2025-67747 High 7.1 Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list 0.3%
• CVE-2025-52556 Critical 9.3 rfc3161-client has insufficient verification for timestamp response signatures 0.2%
• CVE-2023-39969 Critical 9.1 uthenticode signature validation bypass vulnerability 0.6%
• CVE-2023-40012 Medium 5.9 uthenticode EKU validation bypass 0.2%