CWE-693 · Protection Mechanism Failure (page 2)
Page 2 of 9 — CVEs classified under CWE-693, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28655 | High | 7.8 | 2026-09-08 | In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local esc… |
CVE-2026-28650 | High | 7.8 | 2026-09-08 | In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of pri… |
CVE-2026-28642 | High | 7.8 | 2026-09-08 | In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation… |
CVE-2026-28639 | High | 7.8 | 2026-09-08 | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privile… |
CVE-2026-28634 | High | 7.8 | 2026-09-08 | In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This co… |
CVE-2026-28627 | Medium | 4.3 | 2026-09-08 | In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosur… |
CVE-2026-28612 | High | 7.8 | 2026-09-08 | In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to… |
CVE-2026-28599 | High | 7.8 | 2026-09-08 | In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local esc… |
CVE-2026-28594 | High | 7.8 | 2026-09-08 | In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional… |
CVE-2026-28584 | Medium | 5.5 | 2026-09-08 | In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could le… |
CVE-2026-28583 | High | 7.8 | 2026-09-08 | In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This could lead to loca… |
CVE-2026-0084 | High | 7.8 | 2026-09-08 | In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local e… |
CVE-2026-0065 | High | 7.8 | 2026-09-08 | In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due… |
CVE-2026-81376 | Critical | 9.6 | 2026-09-08 | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-77892 | Medium | 6.8 | 2026-09-08 | No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-84811 | Medium | 6.5 | 2026-09-02 | agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping ma… |
CVE-2026-84810 | Medium | 6.5 | 2026-09-02 | claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, a… |
CVE-2026-84809 | Medium | 6.5 | 2026-09-02 | Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd ex… |
CVE-2026-20277 | High | 8.2 | 2026-09-02 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive inter… |
CVE-2026-79686 | High | 8.8 | 2026-09-01 | Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerabili… |
CVE-2026-79684 | High | 8.8 | 2026-09-01 | Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerabili… |
CVE-2026-79683 | High | 8.8 | 2026-09-01 | Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerabili… |
CVE-2026-53508 | | 2026-08-31 | oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did n… | |
CVE-2026-82855 | Critical | 9.8 | 2026-08-31 | @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attac… |
CVE-2026-82474 | High | 7.8 | 2026-08-29 | Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific comman… |
CVE-2026-6876 | | 2026-08-27 | ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated… | |
CVE-2026-59277 | Low | 3.7 | 2026-08-27 | Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a gi… |
CVE-2026-79988 | | 2026-08-27 | The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previous… | |
CVE-2026-61792 | High | 7.7 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read fil… |
CVE-2026-80198 | High | 7.5 | 2026-08-26 | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary… |
CVE-2026-79006 | Medium | 4.3 | 2026-08-25 | Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network… |
CVE-2026-43670 | High | 8.8 | 2026-08-25 | A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18… |
CVE-2026-47624 | Medium | 6.0 | 2026-08-25 | NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability… |
CVE-2026-79774 | High | 8.4 | 2026-08-25 | Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated b… |
CVE-2026-54073 | | 2026-08-21 | VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format a… | |
CVE-2026-76827 | Medium | 6.8 | 2026-08-19 | A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed… |
CVE-2026-52873 | Medium | 6.9 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC han… |
CVE-2026-45733 | High | 8.3 | 2026-08-18 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass la… |
CVE-2026-75874 | Critical | 10.0 | 2026-08-18 | Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, F… |
CVE-2026-74983 | High | 8.1 | 2026-08-18 | Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, T… |
CVE-2026-74959 | Critical | 9.1 | 2026-08-18 | Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thu… |
CVE-2026-74957 | High | 8.1 | 2026-08-18 | Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderb… |
CVE-2026-74938 | Critical | 9.1 | 2026-08-18 | Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-65339 | Medium | 5.0 | 2026-08-17 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionO… |
CVE-2026-47686 | Critical | 9.9 | 2026-08-17 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppr… |
CVE-2026-71858 | | 2026-08-17 | Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation appl… | |
CVE-2026-74896 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute… |
CVE-2026-74895 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute mali… |
CVE-2026-74883 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pa… |
CVE-2026-74790 | Critical | 9.1 | 2026-08-16 | Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose memb… |
CVE-2026-17079 | Medium | 6.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side in… |
CVE-2026-18428 | High | 8.8 | 2026-08-13 | A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to… |
CVE-2026-0293 | Medium | 6.0 | 2026-08-13 | A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protecti… |
CVE-2026-73288 | | 2026-08-12 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objec… | |
CVE-2025-59326 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be… |
CVE-2026-73217 | | 2026-08-11 | Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtu… | |
CVE-2026-73083 | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with impo… | |
CVE-2026-69278 | High | 7.8 | 2026-08-11 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-62902 | Medium | 6.5 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-54981 | High | 7.8 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature… |
CVE-2026-39452 | High | 7.3 | 2026-08-11 | Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applications may allow an escalation of privilege… |
CVE-2026-28757 | | 2026-08-11 | Protection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unpr… | |
CVE-2026-28707 | | 2026-08-11 | Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged softwar… | |
CVE-2026-24693 | | 2026-08-11 | Protection mechanism failure for some Intel(R) oneCCL Bindings for PyTorch before version v2.8.0 within Ring 3: User Applications may allow an escalation of pr… | |
CVE-2026-21400 | | 2026-08-11 | Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege… | |
CVE-2026-21387 | | 2026-08-11 | Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilege. Unprivileged soft… | |
CVE-2026-20906 | Medium | 6.7 | 2026-08-11 | Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privi… |
CVE-2026-20903 | | 2026-08-11 | Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation of privilege. Syste… | |
CVE-2026-20770 | | 2026-08-11 | Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applications may allow an es… | |
CVE-2026-20755 | | 2026-08-11 | Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversar… | |
CVE-2026-20728 | | 2026-08-11 | Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may allow an escalation… | |
CVE-2026-20702 | | 2026-08-11 | Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. Unprivileged software adver… | |
CVE-2026-72781 | High | 8.8 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Becau… |
CVE-2026-19168 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19152 | High | 8.3 | 2026-08-06 | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-19150 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-13342 | Medium | 5.3 | 2026-08-06 | The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing t… |
CVE-2025-15039 | Critical | 9.4 | 2026-08-06 | The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific… |
CVE-2024-6832 | Medium | 5.9 | 2026-08-06 | The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locki… |
CVE-2026-70608 | High | 7.2 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed ifra… |
CVE-2026-70444 | Medium | 4.3 | 2026-08-05 | A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credent… |
CVE-2026-70601 | High | 7.5 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, app… |
CVE-2026-18015 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cra… |
CVE-2026-17943 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML p… |
CVE-2026-17936 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-17931 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-17923 | Medium | 6.5 | 2026-07-30 | Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted domain name. (Chr… |
CVE-2026-17919 | Medium | 6.8 | 2026-07-30 | Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via physi… |
CVE-2026-17899 | High | 8.8 | 2026-07-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-17882 | Medium | 6.5 | 2026-07-30 | Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass site is… |
CVE-2026-17865 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pot… |
CVE-2026-17856 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-17779 | Medium | 5.4 | 2026-07-30 | Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML pa… |
CVE-2026-17776 | Medium | 5.8 | 2026-07-30 | Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-17764 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (… |
CVE-2026-17710 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pote… |
CVE-2026-17695 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cr… |
CVE-2026-17677 | High | 8.8 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-17676 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17674 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML pag… |