CWE-653 Improper Isolation or Compartmentalization

Ghost: Stored XSS via Embed Card Previews

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

Apache Syncope has an Improper Isolation or Compartmentalization vulnerability

pretix: API leaks check-in data between events of the same organizer

Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding

Spring gRPC SecurityContext leaks across requests upon authorization failure

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Keycloak: Replay of action tokens via improper handling of single-use entries

Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

ingress-nginx admission controller RCE escalation

Class Loading Vulnerability in Artemis

Apache Syncope allows malicious administrators to inject Groovy code

DSPy does not properly restrict file reads

Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD

Azure PromptFlow remote code execution related to Jinja templates

The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD