CWE-693 vulnerabilities

The Security Optimizer WordPress plugin versions 1.5.8 through 1.6.4 contain a vulnerability in the IP-based login restriction feature. This flaw allows unauthenticated requests from IP addresses not on the allowlist to bypass the restriction and access the login form, undermining the intended access control.

CVE-2025-15039 is a critical vulnerability in WSO2 Identity Server affecting multiple versions. It involves a protection mechanism failure in the Conditional Authentication (Adaptive Authentication) script, which does not properly enforce completion of all required authentication steps in certain multi-step authentication flows. This flaw allows attackers to bypass intermediate authentication challenges under specific conditions, potentially gaining unauthorized access to user accounts.

CVE-2024-6832 is a vulnerability in WSO2 Enterprise Integrator version 6.6.0 where the account locking mechanism fails to activate if secondary user stores are inaccessible. This inconsistency allows attackers to repeatedly attempt invalid authentications without triggering account lockout for users in accessible stores, exposing them to brute force attacks. The vulnerability has a medium severity with a CVSS score of 5.9.

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted domain name. (Chromium security severity: Low)

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: Medium)

Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-17676 is a critical security vulnerability in Google Chrome on Android prior to version 151.0.7922.72. It involves an inappropriate implementation in the ANGLE component that could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. This vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.