Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

CVEs (904)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-12031 1Google 1Chrome Jun 17, 2026 Jun 11, 2026 N/A· v4 8.3 HIGH· v3 N/A· v2 Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...Show more Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)Show less
CVE-2026-12027 1Google 1Chrome Jun 23, 2026 Jun 11, 2026 N/A· v4 9.6 CRITICAL· v3 N/A· v2 Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chrom...Show more Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)Show less
CVE-2025-30431 1Apple 1Macos Oct 7, 2026 Jun 11, 2026 N/A· v4 5.5 MEDIUM· v3 N/A· v2 The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.
CVE-2025-24284 1Apple 1Macos Oct 7, 2026 Jun 11, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox.
CVE-2026-48546 - - Jul 14, 2026 Jun 11, 2026 8.5 HIGH· v4 7.3 HIGH· v3 N/A· v2 KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandb...Show more KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions and achieving remote code execution with full GitHub Actions runner privileges including access to AUTOMATION_PR_TOKEN.Show less
CVE-2026-50564 - - Jun 17, 2026 Jun 10, 2026 N/A· v4 9.9 CRITICAL· v3 N/A· v2 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Environment CRD exposes spec.runtime.podSpe...Show more Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder pods. The merge logic propagated hostNetwork, hostPID, hostIPC, container privileged, and serviceAccountName from the user-supplied podspec with no filtering, and Environment.Validate performed no security-relevant checks on these fields. This issue has been patched in version 1.24.0.Show less
CVE-2026-50545 - - Jun 17, 2026 Jun 10, 2026 N/A· v4 9.9 CRITICAL· v3 N/A· v2 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.p...Show more Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. This issue has been patched in version 1.24.0.Show less
CVE-2026-48575 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 7.9 HIGH· v3 N/A· v2 Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CVE-2026-48570 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 7.9 HIGH· v3 N/A· v2 Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CVE-2026-48568 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 7.9 HIGH· v3 N/A· v2 Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CVE-2026-47656 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 7.9 HIGH· v3 N/A· v2 Protection mechanism failure in Windows Boot Manager allows an authorized attacker to bypass a security feature locally.
CVE-2026-45656 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.
CVE-2026-45655 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVE-2026-45595 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-45588 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Jun 9, 2026 N/A· v4 7.9 HIGH· v3 N/A· v2 Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CVE-2026-45459 1Microsoft 4365 Apps Microsoft 365Office 2021+1 more Jun 19, 2026 Jun 9, 2026 N/A· v4 3.3 LOW· v3 N/A· v2 Protection mechanism failure in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-11695 1Google 1Chrome Jul 23, 2026 Jun 9, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-11684 1Google 1Chrome Jul 23, 2026 Jun 9, 2026 N/A· v4 3.1 LOW· v3 N/A· v2 Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security...Show more Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)Show less
CVE-2026-11292 1Google 1Chrome Jul 23, 2026 Jun 5, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Insufficient policy enforcement in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-11288 1Google 1Chrome Jul 23, 2026 Jun 5, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Insufficient policy enforcement in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Previous 1...181920...46 Next