Improper Protection of Alternate Path

Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited i

• Pre-auth

yiiframework · yiiApr 9, 2025

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running

• Pre-auth

vbulletin · vbulletinMay 27, 2025

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.

• pre-auth RCE

vbulletin · vbulletinMay 27, 2025

A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (

siemens · himed cockpit 12 proOct 8, 2024

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upl

cisco · identity services engineNov 21, 2023

Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell

• Local privilege escalation

docker · docker desktopSep 25, 2023

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

• Pre-auth

ash-project · ash_luaSep 7, 2026

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use t

openstack · ironicJul 10, 2026

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching works

• Pre-auth

pcre · pcre2Sep 5, 2026

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE

crewai · crewaiSep 13, 2026

ABB PB610 HMIStudio accepts malicious DLL file in an application

abb · pb610 panel builder 600Dec 18, 2019

KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened

• Local privilege escalation

kioware · kiowareMay 14, 2024

IBM MQ privilege escalation

• Local privilege escalation

ibm · mq applianceNov 2, 2023

PB610 HMISimulator provides interface with access to arbitrary files

• Pre-auth

abb · pb610 panel builder 600Dec 18, 2019

Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass

paloaltonetworks · prisma browserMay 13, 2026

In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing

kioware · kiowareMay 14, 2024

Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged con

• Local privilege escalation

docker · docker desktopMar 13, 2023

Privilege Management for Windows - Elevation of Privilege

• Local privilege escalation

beyondtrust · privilege management for windowsJul 28, 2025

Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false

• Pre-auth

apache · tikaJul 30, 2026

2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424

dominionvoting · imagecast xJun 24, 2022

AWS API MCP File Access Restriction Bypass

amazon · aws api mcp serverMar 16, 2026

Improper Protection of Alternate Path in GitLab

gitlab · gitlabSep 12, 2024

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

gitea · gitea open source git serverAug 13, 2026

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.

arris · vip1113Jun 2, 2025

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

• Pre-auth

ash-project · ash_authentication_oauth2_serverSep 7, 2026