cve.bz

CWE-693: Protection Mechanism Failure, page 7

Filter

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

What the weakness is: CWE-693 at MITRE

Ask an AI about CWE-693

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-693: Protection Mechanism Failure and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/693.html and https://cve.bz/cve/cwe/693?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2026-16382EPSS 0.6%

    Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  2. 9.1CVE-2026-16380EPSS 0.4%

    Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  3. 9.8CVE-2026-16377EPSS 0.6%

    Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  4. 9.1CVE-2026-16370EPSS 0.4%

    Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

  5. 9.8CVE-2026-16356EPSS 0.6%

    Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

  6. 7.2CVE-2026-44982EPSS 0.4%

    CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Enco…

  7. 6.1CVE-2026-56087EPSS 0.2%

    Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with physical access could potentially exploit this vulnerability, leading to unauthorized access to encrypted data.

  8. 6.0CVE-2026-49981EPSS 0.4%

    Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allo…

  9. 6.0CVE-2026-48808EPSS 0.4%

    Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions ar…

  10. 7.1CVE-2026-48807EPSS 0.4%

    Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringa…

  11. 7.1CVE-2026-48806EPSS 0.4%

    Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling Sandbox…

  12. 5.3CVE-2026-48805EPSS 0.5%

    Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such…

  13. 7.1CVE-2026-46639EPSS 0.4%

    Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property and method policy checks and allowing an…

  14. 6.0CVE-2026-46638EPSS 0.5%

    Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, …

  15. 7.7CVE-2026-46634EPSS 0.6%

    Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a s…

  16. 6.1CVE-2026-49459EPSS 0.4%

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant …

  17. 6.1CVE-2026-49458EPSS 0.4%

    DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructo…

  18. 7.8CVE-2026-50646EPSS 4.0%

    Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

  19. 7.8CVE-2026-47305EPSS 0.5%

    Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

  20. 4.6CVE-2026-50661EPSS 0.5%

    Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

  21. 6.5CVE-2026-34348EPSS 1.0%

    Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.

  22. 2.1CVE-2026-15618EPSS 0.4%

    A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the function guardExecCommand of the file tools/tool_exec.go of the component exec Safety Guard. The manipulation results in protection mechanism …

  23. 1.9CVE-2026-15528EPSS 0.2%

    A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Performing a manipulation of the argument project_path/schematic_path results in prot…

  24. 8.5CVE-2026-61437EPSS 0.2%

    PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a s…

  25. 6.9CVE-2026-60086EPSS 0.3%

    PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers can craft…

  26. 4.9CVE-2026-59854EPSS 0.5%

    SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacker-supplied absolute source paths and relies on util.IsSensitivePath in kernel/util/path.go, whose denylist misses …

  27. 5.8CVE-2026-0278EPSS 0.2%

    Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.

  28. 4.3CVE-2026-59223EPSS 0.4%

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings and non-label-boundary suffixes, allowing path-based…

  29. 7.1CVE-2026-59207EPSS 0.4%

    n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, …

  30. 9.8CVE-2026-14535EPSS 0.6%

    In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsa…

  31. 2.1CVE-2026-14625EPSS 0.4%

    A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file tui_gateway/server.py. The manipulation results in protection mechanism failure. It is possible to l…

  32. 7.6CVE-2025-71373EPSS 0.6%

    picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbi…

  33. 7.6CVE-2026-14440EPSS 0.2%

    Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design (e.g. 'issue "lets…

  34. 7.5CVE-2026-14409EPSS 0.4%

    Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secur…

  35. 8.3CVE-2026-14151EPSS 0.3%

    Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

  36. 9.6CVE-2026-14120EPSS 0.3%

    Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severit…

  37. 9.6CVE-2026-14101EPSS 0.3%

    Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit…

  38. 9.6CVE-2026-14097EPSS 0.3%

    Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium sec…

  39. 4.3CVE-2026-14092EPSS 0.2%

    Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via malicious network traffic. (Chromium security severity: Low)

  40. 4.3CVE-2026-14076EPSS 0.2%

    Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

  41. 6.5CVE-2026-14059EPSS 0.3%

    Insufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

  42. 4.3CVE-2026-14058EPSS 0.3%

    Insufficient policy enforcement in Parser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

  43. 6.5CVE-2026-14050EPSS 0.3%

    Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

  44. 9.6CVE-2026-14037EPSS 0.3%

    Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity:…

  45. 9.6CVE-2026-14017EPSS 0.3%

    Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security sever…

  46. 8.3CVE-2026-13951EPSS 0.3%

    Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity:…

  47. 6.5CVE-2026-13910EPSS 0.3%

    Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  48. 9.6CVE-2026-13909EPSS 0.3%

    Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security seve…

  49. 6.5CVE-2026-13904EPSS 0.3%

    Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

  50. 6.5CVE-2026-13886EPSS 0.3%

    Insufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)