Skip to content
OpenAdvisories

Weakness (CWE)

CWE-653: Improper Isolation or Compartmentalization

Class Draft

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.

Source: MITRE CWE-653

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-12295 Public exploit

    Sandbox escape in the DOM: Navigation component

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • High 7.4
    CVE-2026-4282 Public exploit

    Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

    A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creatio…

    Red Hat Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.4.11 Maven
  • Critical 9.6
    CVE-2026-4692 Public exploit

    Sandbox escape in the Responsive Design Mode component

    Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.2
    CVE-2026-0542 Public exploit

    Remote Code Execution in ServiceNow AI Platform

    ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.    ServiceNow a…

    ServiceNow ServiceNow AI Platform
  • Critical 9.8
    CVE-2025-1974 Public exploit EPSS 99%

    ingress-nginx admission controller RCE escalation

    A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secret…

    Kubernetes ingress-nginx k8s.io/ingress-nginx Go
  • Medium 5.1
    CVE-2024-8118 Public exploit

    Grafana alerting wrong permission on datasource rule write endpoint

    In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine