Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,049 results · Feed
-
High 8.8
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null rece…
-
High 8.4CVE-2026-79298 Public exploit
An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcke…
-
Medium 6.7
In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. T…
-
High 7.8
In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. T…
-
Medium 6.7
In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of …
-
Medium 6.7
In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the co…
-
Medium 6.7
In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. This could…
-
Medium 6.7
In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to …
-
High 8.8CVE-2026-58704 Exploited
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (p…
KEV Sep 16, 2026 -
High 7.8
In Bootloader, there is a possible permission bypass due to a logic error in the code. This could lead to local escalat…
-
High 8.4
In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to r…
-
Medium 4.4
In acfw_ffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information d…
-
High 7.8
In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of…
-
Medium 6.7
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local…
-
Medium 6.7
In multiple locations, there is a possible escalation of privilege due to a logic error in the code. This could lead to…
-
High 8.4
In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to loca…
-
High 8.4
In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in the code. This could…
-
High 8.4
In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead t…
-
Critical 9.8
In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead…
-
High 7.8
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local…
-
Medium 6.7
In addr_remap_address_map of remap.c, there is a possible escalation of privilege due to a logic error in the code. Thi…
-
Medium 6.7
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local…
-
High 8.4
In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to…
-
Medium 6.7
In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the …
-
Medium 6.7
In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. This coul…
-
Critical 10.0
MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_built…
-
Critical 9.3
FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive ne…
-
Critical 9.1
Mitigation bypass in the Widget: Win32 component
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
Critical 9.1
Mitigation bypass in the Networking component
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
High 8.8
Mitigation bypass in the Popup Blocker component
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
Critical 9.8
Sandbox escape in the Profile Backup component
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
-
Critical 9.1
Mitigation bypass in the Enterprise Policies component
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
Critical 9.1
Mitigation bypass in the DOM: Networking component
Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
Medium 6.3
Mitigation bypass in the DOM: Notifications component
Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
Critical 9.1
Mitigation bypass in the Remote Settings Client component
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
Medium 5.4
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.1
Mitigation bypass in the Remote Settings Client component
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
Critical 9.6
Sandbox escape in the DOM: Core & HTML component
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
-
High 8.8
PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete original string to…
-
High 7.6
PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment variables and does no…