Weakness (CWE)
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Source: MITRE CWE-693
1,049 results · Feed
-
High 8.8
SQL Query Validation Bypass in OpenSearch Direct Query
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query en…
-
Medium 5.6
Prisma Access Agent: Anti-Tamper Protection Bypass on Windows
A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux,…
-
Medium 6.1
RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps tr…
-
Critical 9.8
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file sy…
-
High 7.7
Cursor: Sandbox escape via tampered Python virtual environments
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invo…
-
High 7.8
Visual Studio Code Python Extension Security Feature Bypass Vulnerability
Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
Visual Studio Code Security Feature Bypass Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
Medium 6.5
.NET Information Disclosure Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
-
High 7.6
Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading
Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied. Top-level module co…
-
Medium 6.3
Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applicati…
-
Medium 5.4
Protection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications ma…
-
Medium 5.4
Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escal…
-
Medium 5.4
Protection mechanism failure for some Intel(R) oneCCL Bindings for PyTorch before version v2.8.0 within Ring 3: User Ap…
-
Medium 5.4
Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applicatio…
-
Medium 5.4
Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an es…
-
Medium 5.4
Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Appli…
-
Medium 5.4
Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may…
-
Medium 5.4
Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within R…
-
Medium 5.4
Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of p…
-
Medium 5.4
Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: Us…
-
High 8.9
Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information…
-
High 8.8CVE-2026-72781 Public exploit
Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape
Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox all…
-
High 8.3
Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who ha…
-
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitr…
-
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitr…
-
Medium 5.3
Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can…
-
Critical 9.4
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass…
-
Medium 5.9
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authent…
-
Medium 4.3
A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Over…
-
High 7.2
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler wi…
-
High 7.5
Electron: Context isolation bypass via Function.prototype.bind hijack
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a co…
-
Critical 9.6
Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potent…
-
Medium 4.3
Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass cont…
-
Medium 6.5
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convince…
-
Medium 6.5
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass na…
-
Medium 6.5
Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation rest…
-
Medium 6.8
Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker t…
-
High 8.8
Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a…
-
Medium 6.5
Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install…
-
Critical 9.6
Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had…