# CWE-273.

Every Advisory and CVE whose sources give the weakness CWE-273, newest first.

## Records, newest first

- [Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8…](https://agentprime.io/advisories/CVE-2026-86385.md)
  `CVE-2026-86385` · CVE record: Dell PowerProtect Data Domain · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-273
- [Multiple jail filesystem root escapes](https://agentprime.io/advisories/CVE-2026-101306.md)
  `CVE-2026-101306` · CVE record: FreeBSD FreeBSD · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-273, CWE-281
- [Multiple jail filesystem root escapes](https://agentprime.io/advisories/CVE-2026-101305.md)
  `CVE-2026-101305` · CVE record: FreeBSD FreeBSD · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-273
- [Multiple jail filesystem root escapes](https://agentprime.io/advisories/CVE-2026-101304.md)
  `CVE-2026-101304` · CVE record: FreeBSD FreeBSD · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-273
- [PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend](https://agentprime.io/advisories/GHSA-5r6c-gj4g-r697.md)
  `GHSA-5r6c-gj4g-r697`, `CVE-2026-60085`, `PYSEC-2026-4250` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-273
- [Hugging Face Transformers downloads custom generation code before trust consent](https://agentprime.io/advisories/GHSA-x9r9-c232-4q39.md)
  `GHSA-x9r9-c232-4q39`, `CVE-2026-80047`, `PYSEC-2026-4174` · PyPI `transformers`: affected `>=4.49.0, <=5.8.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Race condition, CWE-273, CWE-494
- [hwpmc fails to detach PMCs during exec credential transitions](https://agentprime.io/advisories/CVE-2026-58089.md)
  `CVE-2026-58089` · CVE record: FreeBSD FreeBSD · CVSS 7.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-273
- [accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts](https://agentprime.io/advisories/CVE-2026-61897.md)
  `CVE-2026-61897` · CVE record: Canonical accountsservice · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-273
- [ktrace(2) privilege incorrectly validated in jails](https://agentprime.io/advisories/CVE-2026-58086.md)
  `CVE-2026-58086` · CVE record: FreeBSD FreeBSD · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-273
- [unlinkat(2) ignores AT_RESOLVE_BENEATH flag](https://agentprime.io/advisories/CVE-2026-49421.md)
  `CVE-2026-49421` · CVE record: FreeBSD FreeBSD · CVSS 7.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-273
- [sh \_uid does not drop supplementary groups (incomplete privilege drop)](https://agentprime.io/advisories/GHSA-q38v-wp89-2w55.md)
  `GHSA-q38v-wp89-2w55`, `CVE-2026-54552`, `PYSEC-2026-3540` · PyPI `sh`: affected `<2.2.4`, fixed in `2.2.4` · CVSS 7.9 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-273
- [Duplicate Advisory: PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend](https://agentprime.io/advisories/GHSA-65c8-r727-2mpj.md)
  `GHSA-65c8-r727-2mpj` · PyPI `praisonai`: affected `<=4.6.77`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-273
- [id: groups= computed from real GID instead of effective GID](https://agentprime.io/advisories/GHSA-47c7-qrm7-mqw7.md)
  `GHSA-47c7-qrm7-mqw7`, `CVE-2026-35370` · crates.io `uu_id`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.4 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control, CWE-273
- [seteuid failure ignored in auth modules](https://agentprime.io/advisories/CVE-2026-44073.md)
  `CVE-2026-44073` · CVE record: Netatalk Netatalk · CVSS 4.0 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-273
- [xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails](https://agentprime.io/advisories/CVE-2026-32107.md)
  `CVE-2026-32107` · CVE record: neutrinolabs xrdp · CVSS 8.8 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-273
- [theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution](https://agentprime.io/advisories/GHSA-2j3p-gqw5-g59j.md)
  `GHSA-2j3p-gqw5-g59j`, `CVE-2026-21882` · crates.io `theshit`: affected `<0.2.0`, fixed in `0.2.0` · CVSS 8.4 High · Not analysed yet · Published 2 Mar 2026 · Tags: Privilege escalation, CWE-273
- [Mastodon streaming API fails to disconnect disabled and suspended users](https://agentprime.io/advisories/CVE-2025-62175.md)
  `CVE-2025-62175` · CVE record: mastodon mastodon · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: CWE-273, CWE-274
- [A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0).](https://agentprime.io/advisories/CVE-2025-27396.md)
  `CVE-2025-27396` · CVE record: Siemens SCALANCE LPE9403 · CVSS 8.7 High · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-273
- [HP Anyware Agent for Linux – Potential Authentication Bypass](https://agentprime.io/advisories/CVE-2025-1003.md)
  `CVE-2025-1003` · CVE record: HP, Inc. HP Anyware Linux Agent · CVSS 8.5 High · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-273
- [Privilege escalation vulnerability](https://agentprime.io/advisories/CVE-2024-38813.md)
  `CVE-2024-38813` · CVE record: VMware vCenter Server and 1 more · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.17 · Not analysed yet · Published 17 Sept 2024 · Tags: Privilege escalation, CWE-273
- [Mozilla Firefox: Internal browser event interfaces were exposed to web content when privileged…](https://agentprime.io/advisories/CVE-2024-8382.md)
  `CVE-2024-8382` · CVE record: Mozilla Firefox and 2 more · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2024 · Tags: CWE-273
- [Keycloak vulnerable to impersonation via logout token exchange](https://agentprime.io/advisories/GHSA-7fpj-9hr8-28vh.md)
  `GHSA-7fpj-9hr8-28vh`, `CVE-2023-0657` · Maven `org.keycloak:keycloak-services`: affected `<22.0.10 || >=23.0.0, <24.0.3`, fixed in `22.0.10`, `24.0.3` · CVSS 3.4 Low · Not analysed yet · Published 17 Apr 2024 · Tags: Broken access control, Authentication bypass, Weak cryptography or TLS, CWE-273
- [Mattermost Server Improper Access Control](https://agentprime.io/advisories/GHSA-xp9j-8p68-9q93.md)
  `GHSA-xp9j-8p68-9q93`, `BIT-mattermost-2024-21848`, `CVE-2024-21848`, `GO-2024-2707` · Go `github.com/mattermost/mattermost/server/v8`: affected `<8.1.11`, fixed in `8.1.11` · CVSS 3.1 Low · Not analysed yet · Published 5 Apr 2024 · Tags: Broken access control, CWE-273
- [Ignite Realtime Openfire privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-5xvc-rwv8-86p7.md)
  `GHSA-5xvc-rwv8-86p7`, `CVE-2024-25420` · Maven `org.igniterealtime.openfire:xmppserver`: affected `<4.8.1`, fixed in `4.8.1` · CVSS 7.2 High · Not analysed yet · Published 26 Mar 2024 · Tags: Broken access control, CWE-273
- [netfilter: nft_ct: skip expectations for confirmed conntrack](https://agentprime.io/advisories/CVE-2021-47129.md)
  `CVE-2021-47129` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 15 Mar 2024 · Tags: CWE-273
- [netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction](https://agentprime.io/advisories/CVE-2023-52433.md)
  `CVE-2023-52433` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-273
- [top-level shadow reference dropped too early for 64-bit PV guests](https://agentprime.io/advisories/CVE-2023-34322.md)
  `CVE-2023-34322` · CVE record: Xen Xen · CVSS 7.8 High · Not analysed yet · Published 5 Jan 2024 · Tags: CWE-273
- [copy_file_range insufficient capability rights check](https://agentprime.io/advisories/CVE-2023-5369.md)
  `CVE-2023-5369` · CVE record: FreeBSD FreeBSD · No CVSS score · Not analysed yet · Published 4 Oct 2023 · Tags: CWE-273
- [In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation.](https://agentprime.io/advisories/CVE-2023-35692.md)
  `CVE-2023-35692` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Jul 2023 · Tags: CWE-273
- [In ShortcutInfo of ShortcutInfo.java, there is a possible way for an app to retain notification listening access due to an uncaught exception.](https://agentprime.io/advisories/CVE-2023-21246.md)
  `CVE-2023-21246` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023 · Tags: CWE-273
- [Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.](https://agentprime.io/advisories/CVE-2023-34844.md)
  `CVE-2023-34844` · CVE record · No CVSS score · Not analysed yet · Published 29 Jun 2023 · Tags: CWE-273
- [A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation.](https://agentprime.io/advisories/CVE-2022-0358.md)
  `CVE-2022-0358` · CVE record: QEMU/virtiofsd · No CVSS score · Not analysed yet · Published 29 Aug 2022 · Tags: CWE-273
- [Apache Superset allows authenticated users to access metadata they have no permission to](https://agentprime.io/advisories/GHSA-748r-5r8q-273m.md)
  `GHSA-748r-5r8q-273m`, `BIT-superset-2021-37839`, `CVE-2021-37839`, `PYSEC-2026-776` · PyPI `apache-superset`: affected `<1.5.1`, fixed in `1.5.1` · CVSS 4.3 Medium · Not analysed yet · Published 7 Jul 2022 · Tags: CWE-273
- [Moodle does not revoke role capabilities correctly](https://agentprime.io/advisories/GHSA-g9m2-c2x5-fr2v.md)
  `GHSA-g9m2-c2x5-fr2v`, `CVE-2019-14879`, `PKSA-tsyk-q1km-44v1` · Packagist `moodle/moodle`: affected `>=3.5.0, <3.5.9 || >=3.6.0, <3.6.7 || >=3.7.0, <3.7.3`, fixed in `3.5.9`, `3.6.7`, `3.7.3` · CVSS 4.2 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-264, CWE-273
- [gnome-shell: Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege…](https://agentprime.io/advisories/CVE-2021-3982.md)
  `CVE-2021-3982` · CVE record: gnome-shell · No CVSS score · Not analysed yet · Published 29 Apr 2022 · Tags: CWE-273
- [Improper Privilege Management in Apache Ozone](https://agentprime.io/advisories/GHSA-86fh-j58m-7pf5.md)
  `GHSA-86fh-j58m-7pf5`, `CVE-2021-36372` · Maven `org.apache.ozone:ozone-main`: affected `<1.2.0`, fixed in `1.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Nov 2021 · Tags: CWE-273
- [An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11.](https://agentprime.io/advisories/CVE-2019-18276.md)
  `CVE-2019-18276` · CVE record · CVSS 7.8 High · Not analysed yet · Published 28 Nov 2019 · Tags: CWE-273

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-273>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-273/>. Everything for agents: <https://agentprime.io/llms.txt>.