Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,057 results · Feed
-
High 8.1
SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
KEV Feb 12, 2026 -
Critical 10.0CVE-2026-23830 Public exploit
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Function` constr…
-
Medium 6.5
Mitigation bypass in the Privacy: Anti-Tracking component
Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 147.0.2.
-
Critical 9.8
vm2 has a Sandbox Escape
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js…
-
Low 3.5
HCL AION is affected by a Missing Security Response Headers vulnerability.
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.
-
Critical 10.0CVE-2026-22686 Public exploit
Sandbox Escape via Host Error Prototype Chain in enclave-vm
Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-vm that allows untrusted, sandboxed JavaScript code to execute arbitrary code in the host Node.js run…
-
Medium 5.5
Windows Remote Assistance Security Feature Bypass Vulnerability
Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally.
-
Critical 10.0
Sandbox escape in the Messaging System component
Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.
-
High 8.1
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
-
High 8.8
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks po…
-
Medium 5.3
EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism
A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. This manipulation causes protection mechanism failure. The attack may be initiated remotely. T…
-
Critical 9.9CVE-2025-68668 EPSS 13%
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulne…
-
High 8.4
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, mac…
-
Medium 5.5
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.2. An…
-
Medium 4.7
HCL BigFix Remote Control is vulnerable to an insecure CSP configuration
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
-
Low 3.9
Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store
Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attacker to inherit TCC permissions via copying the binary to a tmp folder.
-
Medium 5.7
Privilege boundary violation in Radiometer Products
A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside t…
-
Medium 6.8
ASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism Failure
Certain motherboard models developed by ASRock and its subsidiaries, ASRockRack and ASRockInd. has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to re…
-
Medium 6.8
MSI｜Motherboard - Protection Mechanism Failure
Certain motherboard models developed by MSI has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the O…
-
Medium 6.8
GIGABYTE｜Motherboard - Protection Mechanism Failure
Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before …
-
Critical 9.1
When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system wit…
-
Critical 9.1CVE-2025-65318 Public exploit
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system with…
-
Medium 6.8
In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead …
-
High 7.8
Zoom Rooms for Windows - Software Downgrade Protection Mechanism Failure
Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access.
-
Medium 5.3
HTTP/HTTPS Traffic Interception Bypass in mad-proxy
mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below allow attackers to bypass HTTP/HTTPS traffic interception rules, potentially exposing sensitive tra…
-
High 7.1
Legality WHISTLEBLOWING Missing Critical HTTP Security Headers
Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deployments omit Content-Security-Policy, Referrer-Policy, Permissions-Policy, Cross-Origin-Embedder-Poli…
-
Medium 6.3CVE-2025-66204 Public exploit
WBCE CMS allows brute-force protection bypass using X-Forwarded-For header
WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying `X-Forwarded-For` on each request, gaining unlimited password guessing attempts, effectively bypa…
-
High 8.8
In multiple locations, there is a possible way to launch an application from the background due to a precondition check…
-
Low 1.8
Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing
Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not prop…
-
Low 3.7
Envoy forwards early CONNECT data in TCP proxy mode
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the …
-
Medium 6.2
Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZ…
-
Medium 6.9
Security Snapshot May Use Unintended Timestamp When Only ISAR_APT_SNAPSHOT_DATE Is Set
Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has…
-
Medium 5.3
WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass
The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the plugin only checking for the existence of the Authorization header in a request when determining if …
-
Medium 5.0
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
-
Medium 6.4
Protection mechanism failure in the UEFI firmware for the Slim Bootloader within firmware may allow an escalation of pr…
-
Medium 6.5
Protection mechanism failure for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of servi…
-
Medium 6.3
Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Appl…
-
Medium 6.5
Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Appl…
-
Medium 4.4
Collision in minifilter driver of Avast Free Antivirus results in disabling of real-time protection
Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disable real-time protection and self-defense mechanisms.
-
Medium 5.3
Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak c…