Trailofbits
11 CVEs across 3 Trailofbits products. Browse Trailofbits vulnerabilities, severities, and proof-of-concept exploits.
Trailofbits products with known CVEs
Trailofbits CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-14535 | High | 8.8 | 2026-07-04 | In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on ev… |
CVE-2026-14534 | High | 8.8 | 2026-07-04 | Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_… |
CVE-2026-33753 | Medium | 6.2 | 2026-04-08 | rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to 1.0.6, an Authorization Bypass vulnerability in r… |
CVE-2026-22612 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. T… |
CVE-2026-22609 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag s… |
CVE-2026-22608 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other exist… |
CVE-2026-22607 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Beca… |
CVE-2026-22606 | High | 7.8 | 2026-01-10 | Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because… |
CVE-2025-67748 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module… |
CVE-2025-67747 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module im… |
CVE-2025-52556 | | | 2025-06-21 | rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to version 1.0.3, there is a flaw in the timestamp r… |
CVE-2023-40012 | Medium | 5.9 | 2023-08-09 | uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Versions of uthenticode prior to the 2.x series did not… |
CVE-2023-39969 | Critical | 9.0 | 2023-08-09 | uthenticode is a small cross-platform library for partially verifying Authenticode digital signatures. Version 1.0.9 of uthenticode hashed the entire file rath… |