CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778...4.3 Medium
- strapi, strapi @strapi/upload +1 moreStrapi Upload Plugin MIME Validation Bypass via Content API5.3 Medium
- zoom workplaceProtection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an...1.8 Low
- amd epyc™ 8004 series processors, epyc™ embedded 8004 series processors, epyc™ embedded 9004 series processors (formerly codenamed "bergamo") +14 more +16 moreImproper enforcement of the LFENCE serialization property may allow an attacker to bypass...5.7 Medium
- heymrun heymHeym < 0.0.21 Sandbox Escape via Python Introspection8.7 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreSandbox escape in the Profile Backup component9.8 Critical
- apple ipados, macos, safari +5 more +7 moreA validation issue was addressed with improved logic. This issue is fixed in iOS 18.7.9 and...7.5 High
- apple macosA logic issue was addressed with improved file handling. This issue is fixed in macOS Tahoe 26.5....5.5 Medium
- patriksimek vm2vm2 before 3.11.2 Information Disclosure via Internal State6.9 Medium
- legeling prompthubPromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /api/skills/fetch-remote`7.1 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution9.1 Critical
- patriksimek vm2vm2: Transformer Fast-Path Bypass Exposes Internal State Variable5.3 Medium
- patriksimek vm2vm2: sandbox boundary bypass via host Promise resolution preserving host object identity6.5 Medium
- kimaiKimai before 2.56.0 Information Disclosure via config() Twig Function8.7 High
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a...8.1 High
- google chromeInappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote...4.3 Medium
- google chromeInsufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a...4.3 Medium
- google chromeInappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote...5.0 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an...4.3 Medium
- google chromeInappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed...8.1 High
- google chromeInappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a...8.3 High
- google chromeInappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a...3.1 Low
- google chromeInsufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a...4.2 Medium
- google chromeInsufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior...4.3 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an...3.1 Low
- google chromeInsufficient policy enforcement in Downloads in Google Chrome prior to 148.0.7778.96 allowed a...4.4 Medium
- google chromeInsufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96...7.8 High
- google chromeInappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a...3.1 Low
ciguardPyPIciguard: Web UI is missing HTTP defence-in-depth headers2.1 Low- aas-ee open-websearchOpen-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`8.2 High
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 morevm2: WASM Sandbox Escape (Node 25 only)9.8 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 morevm2: Sandbox Escape9.8 Critical
- patriksimek vm2, red hat developer hub, developer hub 1.10 +1 more +3 morevm2: Sandbox Breakout Through Inspect9.8 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 morevm2: Sandbox Breakout Through Promise Species9.8 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 moreVM2 Sandbox Breakout Through __lookupGetter__9.8 Critical
- th30d4y openlearnxOpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment8.8 High
- ruby erb, red hat enterprise linux 10, enterprise linux 10.0 extended update support +10 more +12 moreERB has an @_init deserialization guard bypass via def_module / def_method / def_class8.1 High
- beghelli sicuroweb (sicuro24)Beghelli Sicuro24 SicuroWeb Missing Content Security Policy5.1 Medium
- uutils coreutilsuutils coreutils rm Safeguard Bypass via Improper Path Normalization5.6 Medium
- uutils coreutilsuutils coreutils Path-Based Safety Bypass with --preserve-root6.7 Medium
- spring security, vmware spring security +1 moreServlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers7.5 High
- oracle graalvm, graalvm for jdk, jdk +3 more +5 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...5.3 Medium
- craigjbass clearancekitClearanceKit: opfilter system extension can be suspended or signalled by a root process, disabling file-access policy enforcement8.2 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component5.4 Medium
- mozilla firefox, thunderbird +1 moreMitigation bypass in the File Handling component6.5 Medium
- xiangshan nemuNEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] ...9.8 Critical
- openclawOpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes7.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Shell Security Feature Bypass Vulnerability8.8 High
- microsoft windows, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows Shell Spoofing Vulnerability4.3 Medium
- octobercms octoberOctober CMS: Twig Sandbox Bypass via Collection Methods4.9 Medium
- Show moreLoading…