CWE-653 · weakness in Access Control
Improper Isolation or Compartmentalization
74 CVEs · 1 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
- check available
- 1
- likely to be exploited
- 1
Every one of the 74 is a mark on the map. Named now: 27 to 52, most at risk first.
- lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
- Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw
- Unrestricted network access between execution contexts in KNIME Business Hub
- User in anonymous role could create and delete views
- A user with advanced report application access rights can perform actions for which they are not authorized
- PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
- Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicy
- Centurion ERP user can view projects from organizations they're not apart of
- Kiteworks Core Sandbox Escape
- Boruta dynamic client registration allows creation of over-privileged OAuth clients
- Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability
- Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation
- Beta9 build sandbox escape via chroot-only isolation
- lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.
- lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.
- lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.
- Artemis Java Test Sandbox InvocationTargetException Subclass Escape
- Artemis Java Test Sandbox Class Loading Escape
- An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions…
- Insecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandbox
- SolarWinds Service Desk Broken Access Control Vulnerability
- NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespac…
- yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.
- Vasion Print (formerly PrinterLogic) Lack of Network Segmentation Between Docker Instances
- MrSteam iSteamX Improper Isolation or Compartmentalization
- Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.