Skip to content
OpenAdvisories

Weakness (CWE)

CWE-693: Protection Mechanism Failure

Pillar Draft Mapping discouraged

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE-693

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-44267 Public exploit

    Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

    Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the member_access ha…

    enspirit elo @enspirit/elo npm
  • Critical 10.0
    CVE-2026-92956 Public exploit

    vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

    vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-79657 Public exploit

    NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization

    NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace funct…

    nltk nltk nltk nltk Debian Ubuntu PyPI
  • Critical 9.6
    CVE-2026-12295 Public exploit

    Sandbox escape in the DOM: Navigation component

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.8
    CVE-2026-24118 Public exploit

    VM2 Sandbox Breakout Through __lookupGetter__

    vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue h…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2026-23830 Public exploit

    SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

    SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constr…

    nyariv SandboxJS @nyariv/sandboxjs npm
  • Critical 10.0
    CVE-2026-22686 Public exploit

    Sandbox Escape via Host Error Prototype Chain in enclave-vm

    Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js run…

    agentfront enclave enclave-vm npm
  • Critical 9.1
    CVE-2025-65318 Public exploit

    When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system with…

  • Critical 9.8
    CVE-2024-34144 Public exploit EPSS 48%

    Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

    A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection a…

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  • Critical 9.9
    CVE-2019-1003029 Exploited Public exploit EPSS 74%

    Sandbox bypass in Script Security Plugin

    A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScr…

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
    KEV Apr 25, 2022
  • Critical 9.9
    CVE-2019-1003030 Exploited Public exploit EPSS 97%

    Sandbox bypass in Jenkins Pipeline: Groovy Plugin

    A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the …

    Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2013-2465 Exploited · Ransomware Public exploit EPSS 99%

    Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 …

    KEV Mar 28, 2022