CWE-693 · Protection Mechanism Failure (page 4)
Page 4 of 8 — CVEs classified under CWE-693, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55024 | Critical | 9.8 | 2026-03-03 | An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to per… |
CVE-2026-0017 | High | 7.7 | 2026-03-02 | In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalatio… |
CVE-2026-0012 | Medium | 6.2 | 2026-03-02 | In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local inf… |
CVE-2026-0011 | High | 8.4 | 2026-03-02 | In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead t… |
CVE-2025-48653 | High | 7.8 | 2026-03-02 | In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escal… |
CVE-2025-48635 | High | 7.7 | 2026-03-02 | In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to loc… |
CVE-2025-48605 | High | 8.4 | 2026-03-02 | In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation… |
CVE-2025-48602 | High | 8.4 | 2026-03-02 | In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This… |
CVE-2024-31328 | High | 8.8 | 2026-03-02 | In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from the background on the paired companion… |
CVE-2025-58406 | Medium | 4.3 | 2026-03-02 | The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe… |
CVE-2026-2803 | High | 7.5 | 2026-02-24 | Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2768 | Critical | 10.0 | 2026-02-24 | Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2761 | Critical | 10.0 | 2026-02-24 | Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and T… |
CVE-2026-26994 | Medium | 6.5 | 2026-02-20 | uTLS is a fork of crypto/tls, created to customize ClientHello for fingerprinting resistance while still using it for the handshake. In versions 1.6.7 and belo… |
CVE-2026-20667 | High | 8.8 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3… |
CVE-2025-46290 | High | 7.5 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS So… |
CVE-2026-21513 | High | 8.8 | 2026-02-10 | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-21510 | High | 8.8 | 2026-02-10 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-25115 | Critical | 9.9 | 2026-02-04 | n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of… |
CVE-2026-25056 | High | 8.8 | 2026-02-04 | n8n is an open source workflow automation platform. Prior to versions 1.118.0 and 2.4.0, a vulnerability in the Merge node's SQL Query mode allowed authenticat… |
CVE-2026-0620 | | 2026-02-03 | When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows… | |
CVE-2026-1232 | | 2026-02-02 | A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Under certain conditions, a local authenti… | |
CVE-2026-23553 | Low | 2.9 | 2026-01-28 | In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen'… |
CVE-2025-40536 | High | 8.1 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to g… |
CVE-2026-23830 | Critical | 10.0 | 2026-01-28 | SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `Sandbo… |
CVE-2026-24868 | Medium | 6.5 | 2026-01-27 | Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 147.0.2. |
CVE-2026-22709 | Critical | 9.8 | 2026-01-26 | vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be b… |
CVE-2025-55249 | Low | 3.5 | 2026-01-19 | HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall securi… |
CVE-2026-22686 | Critical | 10.0 | 2026-01-14 | Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sandbox escape vulnerability in enclave-v… |
CVE-2026-20824 | Medium | 5.5 | 2026-01-13 | Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-0881 | Critical | 10.0 | 2026-01-13 | Sandbox escape in the Messaging System component. This vulnerability was fixed in Firefox 147 and Thunderbird 147. |
CVE-2026-0877 | High | 8.1 | 2026-01-13 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thun… |
CVE-2025-69264 | High | 8.8 | 2026-01-07 | pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 sec… |
CVE-2025-15422 | Medium | 5.3 | 2026-01-02 | A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Han… |
CVE-2025-68668 | Critical | 9.9 | 2025-12-26 | n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses… |
CVE-2025-59849 | Medium | 4.7 | 2025-12-17 | Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicio… |
CVE-2025-46291 | High | 7.8 | 2025-12-17 | A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.2. An app may bypass Gatekeeper checks. |
CVE-2025-46281 | High | 8.8 | 2025-12-17 | A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.2. An app may be able to break out of its sandbox. |
CVE-2025-13326 | Low | 3.9 | 2025-12-17 | Mattermost Desktop App versions <6.0.0 fail to enable the Hardened Runtime on the Mattermost Desktop App when packaged for Mac App Store which allows an attack… |
CVE-2025-14095 | Medium | 6.8 | 2025-12-17 | A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physi… |
CVE-2025-14304 | Medium | 6.8 | 2025-12-17 | Certain motherboard models developed by ASRock and its subsidiaries, ASRockRack and ASRockInd. has a Protection Mechanism Failure vulnerability. Because IOMMU… |
CVE-2025-14303 | Medium | 6.8 | 2025-12-17 | Certain motherboard models developed by MSI has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical… |
CVE-2025-14302 | Medium | 6.8 | 2025-12-17 | Certain motherboard models developed by GIGABYTE has a Protection Mechanism Failure vulnerability. Because IOMMU was not properly enabled, unauthenticated phys… |
CVE-2025-65319 | Critical | 9.1 | 2025-12-16 | When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows… |
CVE-2025-65318 | Critical | 9.1 | 2025-12-16 | When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows… |
CVE-2025-36938 | Medium | 6.8 | 2025-12-11 | In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with… |
CVE-2025-67460 | High | 7.8 | 2025-12-10 | Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privile… |
CVE-2025-67485 | Medium | 5.3 | 2025-12-10 | mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below… |
CVE-2025-34413 | | 2025-12-09 | Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deplo… | |
CVE-2025-66204 | High | 8.1 | 2025-12-09 | WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifyi… |
CVE-2025-48626 | Critical | 9.8 | 2025-12-08 | In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote esca… |
CVE-2025-66479 | | 2025-12-04 | Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without re… | |
CVE-2025-64763 | Low | 3.7 | 2025-12-03 | Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle C… |
CVE-2025-29864 | | 2025-12-03 | Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before 12.29. | |
CVE-2025-65100 | | 2025-11-19 | Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the c… | |
CVE-2025-11260 | Medium | 5.3 | 2025-11-13 | The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the… |
CVE-2025-62453 | Medium | 5.0 | 2025-11-11 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
CVE-2025-35968 | Medium | 6.4 | 2025-11-11 | Protection mechanism failure in the UEFI firmware for the Slim Bootloader within firmware may allow an escalation of privilege. Startup code and smm adversary… |
CVE-2025-26402 | Medium | 6.5 | 2025-11-11 | Protection mechanism failure for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with… |
CVE-2025-24848 | Medium | 6.3 | 2025-11-11 | Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of priv… |
CVE-2025-24834 | Medium | 6.5 | 2025-11-11 | Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclo… |
CVE-2025-10905 | Medium | 4.4 | 2025-11-11 | Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disabl… |
CVE-2025-12909 | Medium | 5.3 | 2025-11-08 | Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium… |
CVE-2025-12906 | Medium | 5.4 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-43413 | High | 7.5 | 2025-11-04 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2… |
CVE-2025-60711 | Medium | 6.3 | 2025-10-31 | Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-12554 | Critical | 9.8 | 2025-10-31 | Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12094 | Medium | 5.3 | 2025-10-31 | The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up… |
CVE-2025-0277 | Medium | 6.5 | 2025-10-16 | HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into p… |
CVE-2025-0276 | Medium | 6.5 | 2025-10-16 | HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker… |
CVE-2025-52615 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies control… |
CVE-2025-43296 | Medium | 5.5 | 2025-10-09 | A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26. An app may bypass Gatekeeper checks. |
CVE-2025-55886 | Medium | 6.5 | 2025-09-22 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint… |
CVE-2025-10157 | High | 7.8 | 2025-09-17 | A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals… |
CVE-2025-37124 | High | 8.6 | 2025-09-16 | A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitat… |
CVE-2025-10528 | High | 7.3 | 2025-09-16 | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3… |
CVE-2025-43330 | High | 8.2 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to break out of its san… |
CVE-2025-54917 | Medium | 4.3 | 2025-09-09 | Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-59033 | High | 7.4 | 2025-09-08 | The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TB… |
CVE-2025-26439 | High | 7.8 | 2025-09-04 | In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system compone… |
CVE-2025-26431 | High | 7.8 | 2025-09-04 | In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code… |
CVE-2025-48554 | Medium | 6.1 | 2025-09-04 | In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. This could lead… |
CVE-2025-48546 | High | 7.8 | 2025-09-04 | In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local esca… |
CVE-2025-48534 | High | 8.8 | 2025-09-04 | In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to loca… |
CVE-2025-48531 | High | 7.8 | 2025-09-04 | In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of p… |
CVE-2025-48522 | High | 7.8 | 2025-09-04 | In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to… |
CVE-2025-32331 | High | 7.8 | 2025-09-04 | In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local es… |
CVE-2025-26464 | High | 7.8 | 2025-09-04 | In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-0089 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege wi… |
CVE-2025-26458 | High | 7.8 | 2025-09-04 | In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-26444 | High | 7.8 | 2025-09-04 | In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant applicat… |
CVE-2025-26443 | High | 7.3 | 2025-09-04 | In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic error in th… |
CVE-2025-36905 | High | 7.8 | 2025-09-04 | In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privi… |
CVE-2025-36898 | High | 7.8 | 2025-09-04 | There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2025-9866 | High | 8.8 | 2025-09-03 | Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HT… |
CVE-2025-22437 | High | 7.8 | 2025-09-02 | In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This coul… |
CVE-2025-22434 | High | 7.8 | 2025-09-02 | In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalati… |
CVE-2025-22433 | High | 7.8 | 2025-09-02 | In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due t… |
CVE-2025-22431 | Medium | 5.5 | 2025-09-02 | In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in… |
CVE-2025-22429 | Critical | 9.8 | 2025-09-02 | In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege wit… |