Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,057 results · Feed
-
Medium 5.3
OpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag
OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can leverage the disabled OS…
-
Medium 4.6
Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, a DNS over HTTPS (DoH) vulnerability allows attackers to bypass egress-policy: block network restrictions by tunneling exfiltrated data th…
-
Medium 4.6
Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. In versions 2.15.1 and below, the Harden-Runner that allows bypass of the egress-policy: block network restriction using DNS queries over TCP. Egress policies are enfor…
-
High 8.8CVE-2026-4447 Public exploit
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to execute arbitr…
-
High 8.6
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. Wh…
-
Medium 4.7
HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment
HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment. This may expose the application to potential security risks, including unintended behaviour or integrity impact wh…
-
Critical 10.0
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) on the Backup Server.
-
Critical 9.1
A vulnerability allowing an authenticated user with the Backup Administrator role to perform remote code execution (RCE…
-
High 8.8
A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a Backup…
-
Medium —
kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy
## Summary When inner CPI instructions use instruction types not recognized by Kora's parser (including Token-2022 extension instructions like `ConfidentialTransfer`, `TransferFeeExtension::WithdrawWithheldTokens`, etc.), they are reconstructed as stub instru…
-
Medium 6.3
whyour qinglong API express.ts protection mechanism
A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The…
-
High 8.4
In oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could lead to local escalat…
-
Medium 6.9
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited ke…
-
Medium 6.5
UAA User Token Revocation logic error
Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.
-
High —
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
# Assessment The missing pickle entrypoints `pickle.loads`, `_pickle.loads`, and `_pickle.load` were added to the hook https://github.com/trailofbits/fickling/commit/8c24c6edabceab156cfd41f4d70b650e1cdad1f7. # Original report ## Summary `fickling.always_check…
-
Low —
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
### Summary When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute i…
-
High 8.8
An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231…
-
High 8.8
In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from…
-
High 7.7
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the …
-
Medium 6.2
In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error i…
-
High 8.4
In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a lo…
-
High 8.4
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in …
-
High 7.7
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic e…
-
High 8.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the c…
-
High 8.4
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypas…
-
Medium 5.3
Lack of HTTP Response Headers
The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
-
High 7.5
Information disclosure, mitigation bypass in the Settings UI component
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
-
Critical 10.0
Sandbox escape in the Storage: IndexedDB component
Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
-
Critical 10.0
Sandbox escape in the Graphics: WebRender component
Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
-
Medium 6.5
uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries
uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. In versions 1.6.7 and below, uTLS did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4…
-
High 7.5
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPa…
-
High 8.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4…
-
High 8.8
Windows Shell Security Feature Bypass Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
KEV Feb 10, 2026 -
High 8.8
MSHTML Framework Security Feature Bypass Vulnerability
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
KEV Feb 10, 2026 -
Critical 9.4
n8n is vulnerable to Python sandbox escape
n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. This issue h…
-
Critical 9.4
n8n Arbitrary File Write leading to RCE in n8n Merge Node
n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticated users with permission to create or modify workflows to write arbitrary files to the n8n server's …
-
Medium 6.0
L2TP over IPSec Encryption Failure on ArcherAXE75
When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality.
-
Medium 6.8CVE-2026-1232 Public exploit
Anti-Tamper Bypass in BeyondTrust Privilege Management for Windows
A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Under certain conditions, a local authenticated user with elevated privileges may be able to bypass the product’s anti-tamper protections, whi…
-
Medium 6.5
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
### Summary This vulnerability allows a user to escape the container network isolation and access the host’s local services (127.0.0.1 bound on the host). The vulnerability is applicable only on the MacOS and Windows environments while using Docker Desktop, C…
-
Low 2.9
x86: incomplete IBPB for vCPU isolation
In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Conside…