CWE-693 · Protection Mechanism Failure (page 6)
Page 6 of 9 — CVEs classified under CWE-693, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48626 | Critical | 9.8 | 2025-12-08 | In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote esca… |
CVE-2025-66479 | | 2025-12-04 | Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without re… | |
CVE-2025-64763 | Low | 3.7 | 2025-12-03 | Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle C… |
CVE-2025-29864 | | 2025-12-03 | Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before 12.29. | |
CVE-2025-65100 | | 2025-11-19 | Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISAR_APT_SNAPSHOT_DATE alone does not set the c… | |
CVE-2025-11260 | Medium | 5.3 | 2025-11-13 | The WP Headless CMS Framework plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.15. This is due to the… |
CVE-2025-62453 | Medium | 5.0 | 2025-11-11 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. |
CVE-2025-35968 | Medium | 6.4 | 2025-11-11 | Protection mechanism failure in the UEFI firmware for the Slim Bootloader within firmware may allow an escalation of privilege. Startup code and smm adversary… |
CVE-2025-26402 | Medium | 6.5 | 2025-11-11 | Protection mechanism failure for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with… |
CVE-2025-24848 | Medium | 6.3 | 2025-11-11 | Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of priv… |
CVE-2025-24834 | Medium | 6.5 | 2025-11-11 | Protection mechanism failure for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclo… |
CVE-2025-10905 | Medium | 4.4 | 2025-11-11 | Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disabl… |
CVE-2025-12909 | Medium | 5.3 | 2025-11-08 | Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium… |
CVE-2025-12906 | Medium | 5.4 | 2025-11-08 | Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-43413 | High | 7.5 | 2025-11-04 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2… |
CVE-2025-60711 | Medium | 6.3 | 2025-10-31 | Protection mechanism failure in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2025-12554 | Critical | 9.8 | 2025-10-31 | Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12094 | Medium | 5.3 | 2025-10-31 | The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up… |
CVE-2025-0277 | Medium | 6.5 | 2025-10-16 | HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into p… |
CVE-2025-0276 | Medium | 6.5 | 2025-10-16 | HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker… |
CVE-2025-52615 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies control… |
CVE-2025-43296 | Medium | 5.5 | 2025-10-09 | A logic issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26. An app may bypass Gatekeeper checks. |
CVE-2025-55886 | Medium | 6.5 | 2025-09-22 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint… |
CVE-2025-10157 | High | 7.8 | 2025-09-17 | A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals… |
CVE-2025-37124 | High | 8.6 | 2025-09-16 | A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitat… |
CVE-2025-10528 | High | 7.3 | 2025-09-16 | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3… |
CVE-2025-43330 | High | 8.2 | 2025-09-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to break out of its san… |
CVE-2025-54917 | Medium | 4.3 | 2025-09-09 | Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-59033 | High | 7.4 | 2025-09-08 | The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TB… |
CVE-2025-26439 | High | 7.8 | 2025-09-04 | In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system compone… |
CVE-2025-26431 | High | 7.8 | 2025-09-04 | In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code… |
CVE-2025-48554 | Medium | 6.1 | 2025-09-04 | In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. This could lead… |
CVE-2025-48546 | High | 7.8 | 2025-09-04 | In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local esca… |
CVE-2025-48534 | High | 8.8 | 2025-09-04 | In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to loca… |
CVE-2025-48531 | High | 7.8 | 2025-09-04 | In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of p… |
CVE-2025-48522 | High | 7.8 | 2025-09-04 | In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to… |
CVE-2025-32331 | High | 7.8 | 2025-09-04 | In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local es… |
CVE-2025-26464 | High | 7.8 | 2025-09-04 | In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-0089 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could lead to local escalation of privilege wi… |
CVE-2025-26458 | High | 7.8 | 2025-09-04 | In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to loca… |
CVE-2025-26444 | High | 7.8 | 2025-09-04 | In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant applicat… |
CVE-2025-26443 | High | 7.3 | 2025-09-04 | In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic error in th… |
CVE-2025-36905 | High | 7.8 | 2025-09-04 | In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privi… |
CVE-2025-36898 | High | 7.8 | 2025-09-04 | There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2025-9866 | High | 8.8 | 2025-09-03 | Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HT… |
CVE-2025-22437 | High | 7.8 | 2025-09-02 | In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This coul… |
CVE-2025-22434 | High | 7.8 | 2025-09-02 | In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalati… |
CVE-2025-22433 | High | 7.8 | 2025-09-02 | In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due t… |
CVE-2025-22431 | Medium | 5.5 | 2025-09-02 | In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in… |
CVE-2025-22429 | Critical | 9.8 | 2025-09-02 | In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege wit… |
CVE-2025-22427 | High | 7.3 | 2025-09-02 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in… |
CVE-2024-49720 | High | 7.8 | 2025-09-02 | In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. T… |
CVE-2025-20347 | Medium | 5.4 | 2025-08-27 | A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privile… |
CVE-2025-43728 | Critical | 9.6 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could pote… |
CVE-2025-54143 | Critical | 9.8 | 2025-08-19 | Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vu… |
CVE-2025-50897 | Medium | 4.3 | 2025-08-19 | A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with wr… |
CVE-2025-24835 | Medium | 6.5 | 2025-08-12 | Protection mechanism failure in the Intel(R) Graphics Driver for the Intel(R) Arc(TM) B-Series graphics before version 32.0.101.6737 may allow an authenticated… |
CVE-2025-24523 | Low | 3.5 | 2025-08-12 | Protection mechanism failure for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to… |
CVE-2025-3770 | High | 7.0 | 2025-08-07 | EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability… |
CVE-2025-8656 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on… |
CVE-2025-43273 | Critical | 9.1 | 2025-07-30 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.8. A sandboxed process may b… |
CVE-2025-43261 | Critical | 9.8 | 2025-07-30 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to b… |
CVE-2025-8032 | High | 8.1 | 2025-07-22 | XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13… |
CVE-2025-52951 | Medium | 5.8 | 2025-07-11 | A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the d… |
CVE-2025-46358 | High | 7.7 | 2025-07-11 | Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the produc… |
CVE-2025-49740 | High | 8.8 | 2025-07-08 | Protection mechanism failure in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-48800 | Medium | 6.8 | 2025-07-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-48003 | Medium | 6.8 | 2025-07-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-47984 | High | 7.5 | 2025-07-08 | Protection mechanism failure in Windows GDI allows an unauthorized attacker to disclose information over a network. |
CVE-2025-47159 | High | 7.8 | 2025-07-08 | Protection mechanism failure in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2025-41224 | High | 8.8 | 2025-07-08 | A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.10.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.10.0), RUGGEDCOM RS416NCv2… |
CVE-2025-6427 | Critical | 9.1 | 2025-06-24 | An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connectio… |
CVE-2025-49193 | Medium | 4.2 | 2025-06-12 | The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing… |
CVE-2025-47160 | Medium | 5.4 | 2025-06-10 | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-33050 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-32725 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-31189 | High | 8.2 | 2025-05-29 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may… |
CVE-2025-27700 | High | 8.4 | 2025-05-27 | There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to local escalation of privilege with no additional execution… |
CVE-2025-41232 | Critical | 9.1 | 2025-05-21 | Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may… |
CVE-2025-21081 | Medium | 4.5 | 2025-05-13 | Protection mechanism failure for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated user to potentially enable escala… |
CVE-2025-31244 | High | 8.8 | 2025-05-12 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31224 | High | 7.8 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to b… |
CVE-2025-46553 | Medium | 6.1 | 2025-05-05 | @misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` f… |
CVE-2025-3114 | | 2025-04-09 | Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, pote… | |
CVE-2025-27472 | Medium | 5.4 | 2025-04-08 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-26637 | Medium | 6.8 | 2025-04-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-21384 | High | 8.3 | 2025-04-01 | An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network. |
CVE-2025-24061 | High | 7.8 | 2025-03-11 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2024-56182 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V… |
CVE-2024-56181 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V2… |
CVE-2025-27665 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection and thus drivers can… |
CVE-2025-1222 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2024-13794 | Medium | 5.3 | 2025-02-12 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02… |
CVE-2025-0411 | High | 7.0 | 2025-01-25 | 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installat… |
CVE-2025-0575 | Low | 3.9 | 2025-01-19 | A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the comp… |
CVE-2025-21346 | High | 7.1 | 2025-01-14 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2025-21276 | High | 7.5 | 2025-01-14 | Windows MapUrlToZone Denial of Service Vulnerability |
CVE-2025-21217 | Medium | 6.5 | 2025-01-14 | Windows NTLM Spoofing Vulnerability |
CVE-2025-21211 | Medium | 6.8 | 2025-01-14 | Secure Boot Security Feature Bypass Vulnerability |
CVE-2024-11734 | Medium | 6.5 | 2025-01-14 | A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service… |