CWE-693 vulnerabilities

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that were evaluated as Twig during submission handling, which could lead to serious compromise of the Craft site (depending on template/sandbox behavior). This vulnerability is fixed in 2.2.20 and 3.1.24.

Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the Wireless Control Module (WCM) wiring harness to bypass the anti-theft shutdown. The WCM signals shutdown to a peer ECU via a falling-edge voltage transition on a dedicated wire pair. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit / disconnected condition; interrupting the relevant wires leaves the motorcycle fully operable even though the WCM never validated the rider's PIN. Specific connector details have been withheld pending vendor remediation.

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.

A vulnerability in pam_usb versions prior to 0.9.1 causes the software to silently ignore permission errors when accessing input device nodes, leading to a false negative detection of virtual input devices. This results in the authentication process continuing without denial when it should not, potentially allowing unauthorized access. The issue is fixed in version 0.9.1.

CVE-2026-44451 is a critical protection mechanism failure in the Lumiverse AI chat application prior to version 0.9.7. The vulnerability arises from the component override system that transpiles user-supplied TSX code and evaluates it in a sandbox intended to block dangerous globals. However, both the static source validator and runtime sandbox controls can be bypassed, allowing reconstruction of blocked identifiers and escape to the real window object via DOM references. Exploitation requires a victim to import a malicious theme pack and enable a component override, which then executes code in their authenticated session. This vulnerability is fixed in Lumiverse version 0.9.7.

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.

Strapi versions prior to 5.33.3 contain a vulnerability in the Upload plugin's Content API endpoints where MIME type restrictions configured by administrators were not enforced. This allowed authenticated users with upload permissions to upload disallowed file types such as HTML and SVG. When served from the same origin as the admin panel, these files could execute JavaScript in the admin context, potentially leading to admin session hijacking and unauthorized administrative actions. The issue was fixed in version 5.33.3 by unifying the security checks across all upload entry points.

CVE-2026-30904 is a low-severity vulnerability in Zoom Workplace for iOS versions before 7.0.0. It involves a protection mechanism failure that may allow an authenticated user with physical access to the device to disclose information. The vulnerability does not affect confidentiality broadly, nor does it impact integrity or availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-44003 is a medium severity vulnerability in the open source Node.js sandbox vm2 prior to version 3.11.0. The issue arises from a performance optimization in vm2's code transformer that skips abstract syntax tree (AST) analysis when the code lacks catch, import, or async keywords. This bypass allows sandboxed code to access an internal variable exposing security functions, potentially undermining the sandbox's protection mechanisms. The vulnerability is fixed in vm2 version 3.11.0.

CVE-2026-44000 is a vulnerability in the vm2 Node.js sandbox prior to version 3.11.0 that allows host object identity to leak into the sandbox via host Promise resolution. This occurs because the Promise fulfillment wrapper uses ensureThis() instead of a stronger cross-realm conversion, enabling sandbox code to directly interact with host objects, including identity checks and state mutation. The vulnerability is fixed in vm2 version 3.11.0. The CVSS 3.1 base score is 6.

Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.

CVE-2026-41900 is a high-severity vulnerability in the OpenLearnX platform prior to version 2.0.3. It involves improper neutralization of special elements in OS commands, leading to remote code execution and sandbox escape in the code execution environment. This allows an attacker with limited privileges to execute arbitrary commands on the host system. The vulnerability has been patched in OpenLearnX version 2.0.3.