cve.bz

CWE-693: Protection Mechanism Failure, page 5

Filter

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

What the weakness is: CWE-693 at MITRE

Ask an AI about CWE-693

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-693: Protection Mechanism Failure and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/693.html and https://cve.bz/cve/cwe/693?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-79006EPSS 0.2%

    Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

  2. 8.8CVE-2026-43670EPSS 0.2%

    A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted…

  3. 6.0CVE-2026-47624EPSS 0.2%

    NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi.

  4. 9.3CVE-2026-79774EPSS 0.8%

    Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. A…

  5. 4.6CVE-2026-54073EPSS 0.1%

    VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/…

  6. 6.8CVE-2026-76827EPSS 0.5%

    A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-inde…

  7. 6.9CVE-2026-52873EPSS 0.4%

    Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registe…

  8. 8.3CVE-2026-45733EPSS 0.4%

    Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute e…

  9. 10.0CVE-2026-75874EPSS 0.5%

    Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.

  10. 8.1CVE-2026-74983EPSS 0.4%

    Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  11. 9.1CVE-2026-74959EPSS 0.5%

    Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  12. 8.1CVE-2026-74957EPSS 0.4%

    Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  13. 9.1CVE-2026-74938EPSS 0.4%

    Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

  14. 5.0CVE-2026-65339EPSS 0.2%

    A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sen…

  15. 9.9CVE-2026-47686EPSS 0.6%

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing san…

  16. 5.4CVE-2026-71858EPSS 0.1%

    Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Ope…

  17. 9.3CVE-2026-74896EPSS 0.6%

    openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), …

  18. 9.3CVE-2026-74895EPSS 0.7%

    openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess ex…

  19. 8.7CVE-2026-74883EPSS 0.5%

    openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and w…

  20. 9.3CVE-2026-74790EPSS 0.5%

    Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields b…

  21. 4.3CVE-2026-17079EPSS 0.3%

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter.

  22. 8.7CVE-2026-18428EPSS 1.0%

    A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to…

  23. 5.6CVE-2026-0293EPSS 0.2%

    A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma A…

  24. 6.1CVE-2026-73288EPSS 0.4%

    RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle a…

  25. 9.8CVE-2025-59326EPSS 0.6%

    CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed from these locations.

  26. 7.7CVE-2026-73217EPSS 0.4%

    Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft P…

  27. 7.6CVE-2026-73083EPSS 0.3%

    Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied.…

  28. 7.8CVE-2026-69278EPSS 0.3%

    Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  29. 6.5CVE-2026-62902EPSS 0.9%

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

  30. 7.8CVE-2026-54981EPSS 0.5%

    Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

  31. 6.3CVE-2026-39452EPSS 0.3%

    Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a l…

  32. 5.4CVE-2026-28757EPSS 0.1%

    Protection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexit…

  33. 5.4CVE-2026-28707EPSS 0.2%

    Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may ena…

  34. 5.4CVE-2026-24693EPSS 0.1%

    Protection mechanism failure for some Intel(R) oneCCL Bindings for PyTorch before version v2.8.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a …

  35. 5.4CVE-2026-21400EPSS 0.2%

    Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low comp…

  36. 5.4CVE-2026-21387EPSS 0.2%

    Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may …

  37. 5.4CVE-2026-20906EPSS 0.2%

    Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low…

  38. 5.4CVE-2026-20903EPSS 0.2%

    Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attac…

  39. 5.4CVE-2026-20770EPSS 0.2%

    Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined…

  40. 5.4CVE-2026-20755EPSS 0.2%

    Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escala…

  41. 5.4CVE-2026-20728EPSS 0.2%

    Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a l…

  42. 8.9CVE-2026-20702EPSS 0.4%

    Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enab…

  43. 8.7CVE-2026-72781EPSS 0.8%

    Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute)…

  44. 8.8CVE-2026-19168EPSS 0.4%

    Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  45. 8.3CVE-2026-19152EPSS 0.3%

    Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security s…

  46. 8.8CVE-2026-19150EPSS 0.4%

    Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  47. 5.3CVE-2026-13342EPSS 0.3%

    The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlis…

  48. 9.4CVE-2025-15039EPSS 0.7%

    The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows a…

  49. 7.5CVE-2024-6832EPSS 0.4%

    The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeat…

  50. 7.2CVE-2026-70608EPSS 0.4%

    Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger set…