CWE-653: Separation of Privilege
The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
Also known as Improper Isolation or Compartmentalization.
A kind of CWE-657 Violation of Secure Design Principles.
From the CWE List. © The MITRE Corporation.
Newest
- gen digital avast antivirus, avast one, avast premium security, avast ultimate, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 more Avast sandbox escape via unpreserved COM pathway through Task Scheduler No score
- gen digital avast antivirus, avast one, avast premium security, avast ultimate, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 more Avast sandbox escape via arbitrary file write in virtualized environment No score
- apache software foundation syncope Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass 9.8 Critical
- apache software foundation syncope Apache Syncope: Remote Code Execution via Flowable JUEL expression 9.8 Critical
- beam-cloud beta9 worker Beta9 build sandbox escape via chroot-only isolation 9.9 Critical
- n8n-io n8n n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes 8.7 High
- knime business hub Unrestricted network access between execution contexts in KNIME Business Hub 6.4 Medium
- aws amazon athena Incorrect authorization checks in Amazon Athena engine version 3 query processing 6.3 Medium
- jd-opensource joysafeter JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell 8.7 High
- ginlix-ai langalpha LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge 6.9 Medium
- qnap systems inc. notes station 3 **Container Escape** Host user home directory mounted with write access into application container 8.4 High
- iflytek astron-agent Astron Agent: Unsandboxed code-node leads to cross-tenant RCE 9.9 Critical
- cisco nx-os software Cisco NX-OS Software Python Sandbox Escape Vulnerability 4.4 Medium
- openbsd openssh In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss... 3.1 Low
- tryghost ghost Ghost: Stored XSS via Embed Card Previews 7.3 High
- triggerdotdev trigger.dev Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets 9.2 Critical
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Sandbox Escape 8.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 more Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group 5.7 Medium
- deepseek-ai deepseek-harness deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation 4.8 Medium
- mrsteam isteamx application, isteamx hub +1 more MrSteam iSteamX Improper Isolation or Compartmentalization 8.4 High
- patriksimek vm2 vm2 before 3.11.7 Memory Disclosure via Buffer Pool 10.0 Critical
- gen digital avast free antivirus, avast one, avast premium security, avast ultimate, avast business security, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 more Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys 8.8 High
- vivo kids mode A control logic defect in a specific built-in webpage of Kids Mode allows users to view local... 2.4 Low
- traefik Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef 4.8 Medium
- clastix kamaji Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation 8.5 High
- malach-it boruta Boruta dynamic client registration allows creation of over-privileged OAuth clients 8.3 High
- apache syncope Apache Syncope: Remote Code Execution via Scripted Connector 9.8 Critical
- apache syncope Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask 9.8 Critical
- apache syncope Apache Syncope: RCE via Groovy Sandbox bypass 9.8 Critical
- amazon aws-load-balancer-controller Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller 5.8 Medium
- mervinpraison praisonai PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients 7.6 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 more Sandbox escape due to incorrect boundary conditions in the Networking component 9.6 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 more Sandbox escape in the DOM: Navigation component 9.6 Critical
- imagination technologies graphics ddk GPU DDK - SharedSecMem mapped into all GPU virtual address spaces 5.5 Medium
- apache syncope Apache Syncope: Post-auth RCE via Groovy static 7.2 High
- mozilla firefox, firefox focus, red hat enterprise linux 10 +4 more +6 more Sandbox escape in Firefox and Firefox Focus for Android 7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 more Sandbox escape in the Profile Backup component 9.8 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 more vm2: Sandbox Breakout Through Null Proto Exception 9.8 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 more vm2: Sandbox escape 10.0 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 more vm2: Sandbox Escape 10.0 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 more vm2: WASM Sandbox Escape (Node 25 only) 9.8 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 more vm2: Sandbox Escape 9.8 Critical
- patriksimek vm2, red hat developer hub, developer hub 1.10 +1 more +3 more vm2: Sandbox Breakout Through Inspect 9.8 Critical
- spring grpc, vmware spring grpc +1 more Spring gRPC SecurityContext leaks across requests on authorization failure 4.3 Medium
- traefik Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding 4.8 Medium
- pretix pretix: API leaks check-in data between events of the same organizer 5.5 Medium
- pretix venueless API allows deletion of users of other instance 7.3 High
- electron Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes 6.8 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 more Keycloak: keycloak: replay of action tokens via improper handling of single-use entries 5.3 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 more Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw 7.4 High
- Show olderLoading…