CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeInsufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53...3.1 Low
- google chromeInappropriate implementation in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a...4.3 Medium
- google chromeInappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a...4.3 Medium
- google chromeInsufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed...6.5 Medium
- google chromeInappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a...5.3 Medium
- google chromeInappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53...8.1 High
- google chromeInsufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53...6.5 Medium
- google chromeInsufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53...6.5 Medium
- hcl icontrolHCL iControl was affected by Missing Security Headers vulnerability.3.7 Low
- google androidIn multiple locations, there is a possible way to bypass user interaction when pairing an LE...8.0 High
- google androidIn approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to...7.8 High
- google androidIn resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application...7.8 High
- google androidIn bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure...7.8 High
- google androidIn performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy...7.8 High
- google androidIn multiple locations, there is a possible way to reset user-selected permissions selections due...7.8 High
- aider-ai aiderAider-AI Aider Pre-commit Hook args.py protection mechanism5.3 Medium
- mervinpraison praisonai, < 1.6.40 +1 morePraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)9.9 Critical
- patriksimek vm2vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server8.6 High
- patriksimek vm2vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution10.0 Critical
- patriksimek vm2vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain8.6 High
- patriksimek vm2vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks8.7 High
- patriksimek vm2vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js2.1 Low
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown4.1 Medium
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM voltage-based shutdown4.1 Medium
- honoHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths5.3 Medium
- oisf suricataSuricata lua: excessive flow variable registration can bypass sandbox7.5 High
- crowdsecurity crowdsecCrowdSec AppSec silently drops request body for chunked / HTTP-2 requests7.2 High
- mcdope pam usbpam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution4.4 Medium
- oneuptimeOneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion9.9 Critical
- harttle liquidjsLiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`5.3 Medium
- prolix-oc lumiverseLumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass9.3 Critical
- symfony twigTwig: Sandbox property and method bypass via object-destructuring assignment7.1 High
- symfony twigTwig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)6.0 Medium
- symfony twigTwig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name7.7 High
- hulumi policies@hulumi/policies before 1.3.2 Evidence Validation Bypass9.3 Critical
- klever-io klever-goKlever-Go KVM read-only execution can commit contract delete and upgrade side effects6.3 Medium
- netatalkFORTIFY_SOURCE disabled3.7 Low
- google chromeInsufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179...4.3 Medium
- google chromeInsufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179...4.3 Medium
- symfony twigTwig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface8.7 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component8.1 High
- mozilla firefox, firefox focus, red hat enterprise linux 10 +4 more +6 moreSandbox escape in Firefox and Firefox Focus for Android7.5 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component8.1 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Widget: Win32 component9.6 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure, sandbox escape in the Security: Process Sandboxing component8.6 High
- verbb formieFormie: Pre-authenticated server-side template injection in Hidden fields9.8 Critical
- google chromeInappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a...7.5 High
- google chromeInsufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168...5.3 Medium
- google chromeInsufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168...3.1 Low
- google chromeInsufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168...8.3 High
- Show moreLoading…