Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,041 results · Feed
-
Medium 5.3
Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring
ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each bl…
-
High 8.2
Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10
There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected.
-
Unscored —
Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through…
-
Low 3.5
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing Content Security Policy header.
-
Medium 5.4
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing.
-
Medium 4.4
arbitrary read/write via grant copy
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination pa…
-
High 7.3
Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx
Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.
-
Critical 9.8CVE-2026-44267 Public exploit
Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter
Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access ha…
-
Medium 6.2
In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in t…
-
Low 2.4
In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. Thi…
-
High 8.4
In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. T…
-
Medium 6.8
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physi…
-
High 8.4
In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background activity launch due to a lo…
-
High 8.4
In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This coul…
-
High 8.4
In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the cod…
-
High 8.4
In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error…
-
High 7.5
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to remot…
-
High 8.4
In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead…
-
High 8.4
In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead…
-
High 7.8
In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass v…
-
Medium 4.0
In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due…
-
High 8.4
In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic er…
-
Medium 6.8
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a lo…
-
Medium 4.0
In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This co…
-
Low 2.3
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a req…
-
Critical 9.9
Prefab UI Pyodide sandbox escape to host RCE
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the l…
-
Medium 6.5
Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc
Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a sk…
-
High 8.8
Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNSAFE_IMPORTS denylist, …
-
Medium 6.5
Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token
Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpo…
-
Medium 4.3
PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data
PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
-
Medium 6.5
PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data
PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem …
-
Medium 6.3
Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (…
-
Low 3.6
Protection mechanism failure due to missing binary hardening in Linux executables. The following products are affected:…
-
High 8.8
Mitigation bypass in the DOM: Push Subscriptions component
Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
High 8.8
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.6
Sandbox escape in the DOM: Networking component
Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
High 8.8
Sandbox escape in the Form Manager component
Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Critical 9.6
Sandbox escape in the DOM: Navigation component
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Medium 6.1
DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers l…
-
High 8.4
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, …