Trailofbits · weakness class
Input Validation and Logic
8 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.
- Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
- Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)
- Fickling Blocklist Bypass: cProfile.run()
- Fickling has a bypass via runpy.run_path() and runpy.run_module()
- Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
- Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
- Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list
- Fickling has Code Injection vulnerability via pty.spawn()
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.