CWE-693 · Protection Mechanism Failure (page 4)
Page 4 of 9 — CVEs classified under CWE-693, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53853 | High | 8.3 | 2026-06-16 | OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowl… |
CVE-2026-53845 | Medium | 4.3 | 2026-06-16 | OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverag… |
CVE-2026-12316 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12315 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12302 | Medium | 6.5 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-12296 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird… |
CVE-2026-12295 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thun… |
CVE-2026-12294 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunder… |
CVE-2026-12214 | High | 7.8 | 2026-06-15 | A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus… |
CVE-2026-47209 | High | 8.6 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unc… |
CVE-2026-47140 | Critical | 10.0 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster… |
CVE-2026-47139 | High | 8.6 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With… |
CVE-2026-47135 | High | 8.7 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-r… |
CVE-2026-12031 | High | 8.3 | 2026-06-11 | Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-12027 | Critical | 9.6 | 2026-06-11 | Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potenti… |
CVE-2025-30431 | Medium | 5.5 | 2026-06-11 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able… |
CVE-2025-24284 | High | 8.8 | 2026-06-11 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of it… |
CVE-2026-48546 | High | 7.3 | 2026-06-11 | KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the glob… |
CVE-2026-50564 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-50545 | Critical | 9.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-48575 | High | 7.9 | 2026-06-09 | Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-48570 | High | 7.9 | 2026-06-09 | Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-48568 | High | 7.9 | 2026-06-09 | Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-47656 | High | 7.9 | 2026-06-09 | Protection mechanism failure in Windows Boot Manager allows an authorized attacker to bypass a security feature locally. |
CVE-2026-45656 | High | 7.8 | 2026-06-09 | Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally. |
CVE-2026-45655 | Medium | 5.3 | 2026-06-09 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2026-45595 | Medium | 5.4 | 2026-06-09 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-45588 | High | 7.9 | 2026-06-09 | Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-45459 | Low | 3.3 | 2026-06-09 | Protection mechanism failure in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-11695 | Medium | 4.3 | 2026-06-09 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-11684 | Low | 3.1 | 2026-06-09 | Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak c… |
CVE-2026-11292 | Medium | 4.3 | 2026-06-05 | Insufficient policy enforcement in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2026-11288 | Medium | 6.5 | 2026-06-05 | Insufficient policy enforcement in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-11282 | Critical | 9.6 | 2026-06-05 | Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v… |
CVE-2026-11266 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via a malicious file. (C… |
CVE-2026-11264 | Medium | 4.3 | 2026-06-05 | Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML… |
CVE-2026-11263 | Medium | 6.5 | 2026-06-05 | Insufficient policy enforcement in WebAuthentication in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the rende… |
CVE-2026-11260 | Medium | 4.3 | 2026-06-05 | Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted H… |
CVE-2026-11248 | High | 8.8 | 2026-06-05 | Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-11247 | Low | 3.1 | 2026-06-05 | Insufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf… |
CVE-2026-11234 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2026-11219 | Medium | 4.3 | 2026-06-04 | Inappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HT… |
CVE-2026-11206 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-11174 | Medium | 5.3 | 2026-06-04 | Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to by… |
CVE-2026-11170 | High | 8.1 | 2026-06-04 | Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation… |
CVE-2026-10950 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2026-10944 | Medium | 6.5 | 2026-06-04 | Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2025-52609 | Low | 3.7 | 2026-06-04 | HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering me… |
CVE-2026-0097 | High | 8.0 | 2026-06-01 | In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/a… |
CVE-2026-0087 | High | 7.8 | 2026-06-01 | In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code… |
CVE-2026-0077 | High | 7.8 | 2026-06-01 | In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the code. This could lea… |
CVE-2026-0045 | High | 7.8 | 2026-06-01 | In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. This could lead to l… |
CVE-2025-48652 | High | 7.8 | 2026-06-01 | In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local esc… |
CVE-2025-48649 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation o… |
CVE-2026-10174 | Medium | 6.3 | 2026-05-31 | A vulnerability was identified in Aider-AI Aider 0.86.3. Affected is an unknown function of the file aider/args.py of the component Pre-commit Hook Handler. Su… |
CVE-2026-45697 | Critical | 9.8 | 2026-05-29 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default… |
CVE-2026-49325 | Medium | 4.6 | 2026-05-29 | Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker w… |
CVE-2026-49316 | Medium | 4.6 | 2026-05-29 | Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypas… |
CVE-2026-47676 | Medium | 5.3 | 2026-05-28 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming r… |
CVE-2026-48792 | Medium | 4.4 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, src/evdev.c silently ignores EACCES errors when opening /dev… |
CVE-2026-45102 | Critical | 9.9 | 2026-05-27 | OneUptime is an open-source monitoring and observability platform. Prior to 10.0.98, OneUptime uses the Node.js' vm module as an isolation primitive. This API… |
CVE-2026-44451 | Critical | 9.3 | 2026-05-26 | Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with… |
CVE-2026-44071 | Low | 3.7 | 2026-05-21 | Netatalk 3.1.2 through 4.4.2 is compiled without FORTIFY_SOURCE, which disables built-in buffer overflow detection at runtime, potentially allowing a remote at… |
CVE-2026-9116 | Medium | 4.3 | 2026-05-20 | Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-9115 | Medium | 4.3 | 2026-05-20 | Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a craf… |
CVE-2026-24425 | High | 8.8 | 2026-05-20 | Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template ren… |
CVE-2026-8969 | High | 8.1 | 2026-05-19 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8962 | High | 8.1 | 2026-05-19 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8959 | Critical | 9.6 | 2026-05-19 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbir… |
CVE-2026-8958 | High | 8.6 | 2026-05-19 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderb… |
CVE-2026-8945 | High | 7.5 | 2026-05-19 | Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151. |
CVE-2026-8585 | High | 7.5 | 2026-05-14 | Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-8583 | Medium | 5.3 | 2026-05-14 | Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-8572 | Low | 3.1 | 2026-05-14 | Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-8571 | High | 8.3 | 2026-05-14 | Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-8563 | Medium | 4.3 | 2026-05-14 | Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass navigation restrictio… |
CVE-2026-22707 | Medium | 5.4 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the… |
CVE-2026-30904 | Low | 1.8 | 2026-05-13 | Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical… |
CVE-2026-44003 | Medium | 5.3 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does… |
CVE-2026-44000 | Medium | 6.5 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox throug… |
CVE-2024-36315 | | 2026-05-13 | Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information… | |
CVE-2026-45227 | High | 8.8 | 2026-05-12 | Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox rest… |
CVE-2026-8401 | Critical | 9.8 | 2026-05-12 | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. |
CVE-2026-43660 | High | 7.5 | 2026-05-11 | A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 2… |
CVE-2026-28914 | Medium | 5.5 | 2026-05-11 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously craf… |
CVE-2026-42261 | High | 7.1 | 2026-05-08 | PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts expose… |
CVE-2026-41900 | High | 8.8 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identifie… |
CVE-2026-8018 | High | 8.1 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via malic… |
CVE-2026-8014 | Medium | 4.3 | 2026-05-06 | Inappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2026-8011 | Medium | 4.3 | 2026-05-06 | Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-8009 | Medium | 5.0 | 2026-05-06 | Inappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass navig… |
CVE-2026-8004 | Medium | 4.3 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-7978 | High | 8.1 | 2026-05-06 | Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed a remote attacker to perform OS-level privilege escalation via… |
CVE-2026-7963 | High | 8.3 | 2026-05-06 | Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to pot… |
CVE-2026-7959 | Low | 3.1 | 2026-05-06 | Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-7952 | Medium | 4.2 | 2026-05-06 | Insufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2026-7946 | Medium | 4.3 | 2026-05-06 | Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised… |
CVE-2026-7937 | Low | 3.1 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-7932 | Medium | 4.4 | 2026-05-06 | Insufficient policy enforcement in Downloads in Google Chrome prior to 148.0.7778.96 allowed a local attacker to bypass navigation restrictions via a crafted H… |
CVE-2026-7913 | High | 7.8 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed a local attacker to perform privilege escalation via a m… |