trailofbits records

12 published records for vendor trailofbits.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 83.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

12 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2023-39969No exploit	uthenticode signature validation bypass vulnerabilitytrailofbits · uthenticode · CWE-347 Pre-auth Weak crypto	Critical9.8	—	0.6%	Aug 9, 2023
39Monitor	CVE-2026-14535No exploit	Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()trailofbits · fickling · CWE-693 Pre-auth	Critical9.8	—	0.6%	Jul 4, 2026
35Monitor	CVE-2026-22609No exploit	Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklisttrailofbits · fickling · CWE-184 pre-auth RCE	High8.9	—	0.6%	Jan 9, 2026
35Monitor	CVE-2026-14534No exploit	Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)trailofbits · fickling · CWE-184 Pre-auth Deserialization	High8.8	—	0.6%	Jul 4, 2026
35Monitor	CVE-2026-22607No exploit	Fickling Blocklist Bypass: cProfile.run()trailofbits · fickling · CWE-184 Pre-auth Deserialization	High8.9	—	0.5%	Jan 9, 2026
35Monitor	CVE-2026-22606No exploit	Fickling has a bypass via runpy.run_path() and runpy.run_module()trailofbits · fickling · CWE-184 Pre-auth Deserialization	High8.9	—	0.5%	Jan 9, 2026
35Monitor	CVE-2026-22608No exploit	Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detectiontrailofbits · fickling · CWE-184 pre-auth RCE	High8.9	—	0.4%	Jan 9, 2026
35Monitor	CVE-2026-22612No exploit	Fickling vulnerable to detection bypass due to "builtins" blindnesstrailofbits · fickling · CWE-502 Pre-auth Deserialization	High8.9	—	0.3%	Jan 9, 2026
30Monitor	CVE-2023-40012No exploit	uthenticode EKU validation bypasstrailofbits · uthenticode · CWE-325 Pre-auth	High7.5	—	0.2%	Aug 9, 2023
30Monitor	CVE-2026-33753No exploit	Improper Certificate Validation in rfc3161-clienttrailofbits · rfc3161-client · CWE-295 Pre-auth Weak crypto	High7.5	—	0.2%	Apr 8, 2026
28Monitor	CVE-2025-67747No exploit	Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules listtrailofbits · fickling · CWE-184 RCE Deserialization	High7.1	—	0.3%	Dec 15, 2025
28Monitor	CVE-2025-67748No exploit	Fickling has Code Injection vulnerability via pty.spawn()trailofbits · fickling · CWE-94 RCE	High7.1	—	0.3%	Dec 15, 2025

CVE-2023-39969
39Monitor
uthenticode signature validation bypass vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Weak crypto
trailofbits · uthenticodeAug 9, 2023
CVE-2026-14535
39Monitor
Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
trailofbits · ficklingJul 4, 2026
CVE-2026-22609
35Monitor
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
HighCVSS 8.9No exploitEPSS 1%
- pre-auth RCE
trailofbits · ficklingJan 9, 2026
CVE-2026-14534
35Monitor
Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- Deserialization
trailofbits · ficklingJul 4, 2026
CVE-2026-22607
35Monitor
Fickling Blocklist Bypass: cProfile.run()
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
- Deserialization
trailofbits · ficklingJan 9, 2026
CVE-2026-22606
35Monitor
Fickling has a bypass via runpy.run_path() and runpy.run_module()
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Deserialization
trailofbits · ficklingJan 9, 2026
CVE-2026-22608
35Monitor
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
HighCVSS 8.9No exploitEPSS 0%
- pre-auth RCE
trailofbits · ficklingJan 9, 2026
CVE-2026-22612
35Monitor
Fickling vulnerable to detection bypass due to "builtins" blindness
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Deserialization
trailofbits · ficklingJan 9, 2026
CVE-2023-40012
30Monitor
uthenticode EKU validation bypass
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
trailofbits · uthenticodeAug 9, 2023
CVE-2026-33753
30Monitor
Improper Certificate Validation in rfc3161-client
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
trailofbits · rfc3161-clientApr 8, 2026
CVE-2025-67747
28Monitor
Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Deserialization
trailofbits · ficklingDec 15, 2025
CVE-2025-67748
28Monitor
Fickling has Code Injection vulnerability via pty.spawn()
HighCVSS 7.1No exploitEPSS 0%
- RCE
trailofbits · ficklingDec 15, 2025