CWE-653 · weakness in Access Control
Improper Isolation or Compartmentalization
74 CVEs · 1 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
- check available
- 1
- likely to be exploited
- 1
Every one of the 74 is a mark on the map. Named now: 53 to 74, most at risk first.
- Restricted shell evasion in Radiflow iSAP Smart Collector
- Junos OS: QFX5000 Series and EX Series: Specific malformed LACP packets will cause flaps
- Incorrect oauth passthrough in Grafana Databricks Datasource
- Incorrect oauth passthrough in Grafana Snowflake Datasource
- Network boundaries not respected in certain Foundry namespaces.
- A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective org…
- Keycloak: keycloak: replay of action tokens via improper handling of single-use entries
- Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group
- API allows deletion of users of other instance
- A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page
- vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c.
- Lack of isolation in mcp-run-python leads to MCP server takeover
- Cisco NX-OS Software Python Parser Escape Vulnerability
- Spring gRPC SecurityContext leaks across requests on authorization failure
- Improper Isolation or Compartmentalization in the stream cache mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege…
- Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef
- An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop…
- In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation
- **Container Escape** Host user home directory mounted with write access into application container
- Cisco NX-OS Software Python Sandbox Escape Vulnerability
- GPU DDK - SharedSecMem mapped into all GPU virtual address spaces
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.