CVE-2026-54423: Improper Protection of Alternate Path

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the sendraw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control...

webkitgtk: An app may be able to access sensitive user data

A flaw was found in WebKitGTK. Processing or loading malicious web content can allow an app to access sensitive user data due to improper data protection...

Prisma Access Agent Improper Protection

The vulnerability of the Prisma Access Agent, a user-level remote access agent for corporate resources and applications, is related to improper protection of the alternative path. Exploiting this vulnerability allows an attacker to circumvent existing security restrictions...

EUVD-2026-30062

An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands t...

CVE-2026-0237: Improper Protection of Alternate Path

An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands t...

CVE-2026-4913

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled...

CVE-2026-4913: Improper Protection of Alternate Path

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled...

CVE-2026-4270

Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions = 0.2.14 and 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To...

CVE-2025-68939: Improper Protection of Alternate Path

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API...

Prisma Alternate Path Data Compromise

The vulnerability of the Prisma Browser is related to improper protection of the alternative path. Exploiting this vulnerability allows an attacker to compromise the confidentiality of the protected information...

CVE-2025-58079

Improper Protection of Alternate Path CWE-424 in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications...

CVE-2025-58079

The advisory shows CVE-2025-58079 in desknet’s NEO AppSuite (desknet’s NEO, versions V4.0R1.0–V9.0R2.0) with CWE-424 (Improper Protection of Alternate Path). Root cause: improper access protection enabling a remote attacker to create malicious AppSuite applications. Impact per sources indicates a...

CVE-2025-58079

Improper Protection of Alternate Path CWE-424 in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications...

CVE-2025-58079: Improper Protection of Alternate Path

Improper Protection of Alternate Path CWE-424 in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications...

PT-2025-42457

Name of the Vulnerable Software and Affected Versions desknet NEO AppSuite versions 4.0R1.0 through 9.0R2.0 Description An issue exists in the AppSuite component of desknet's NEO that relates to improper protection of alternate paths. This allows an attacker to create malicious AppSuite...

EUVD-2023-53561

Malicious code in bioql PyPI...

CVE-2025-9709

CVE-2025-9709 concerns the Nordic Semiconductor nRF52810, where the On-Chip Debug and Test Interface has improper access control and insufficient protection against electromagnetic fault injection (EM-FI). Reports describe that an attacker can perform EM fault injection to bypass the built-in APP...

CVE-2025-6250: Improper Protection of Alternate Path

Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions...

vBulletin Code Execution

The vulnerability of the commercial vBulletin web forum is related to improper protection of an alternative path. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2025-49163: Improper Protection of Alternate Path

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file...