# CWE-653.

Every Advisory and CVE whose sources give the weakness CWE-653, newest first.

## Records, newest first (an older page)

- [High Privilege RCE via LUA Sandbox Escape](https://agentprime.io/advisories/CVE-2025-41688.md)
  `CVE-2025-41688` · CVE record: MB connect line mbNET HW1 and 3 more · CVSS 7.2 High · Not analysed yet · Published 31 Jul 2025 · Tags: CWE-653
- [Restricted shell evasion in Radiflow iSAP Smart Collector](https://agentprime.io/advisories/CVE-2025-27027.md)
  `CVE-2025-27027` · CVE record: Radiflow iSAP Smart Collector · CVSS 4.1 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-653
- [Eclipse Foundation Eclipse Open VSX Registry: A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have…](https://agentprime.io/advisories/CVE-2025-6705.md)
  `CVE-2025-6705` · CVE record: Eclipse Foundation Eclipse Open VSX Registry · CVSS 7.6 High · Not analysed yet · Published 27 Jun 2025 · Tags: CWE-653, CWE-913
- [Sony XAV-AX8500 Bluetooth Improper Isolation Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-5476.md)
  `CVE-2025-5476` · CVE record: Sony XAV-AX8500 · CVSS 6.3 Medium · Not analysed yet · Published 21 Jun 2025 · Tags: CWE-653
- [Fortinet FortiClientMac: An improper isolation or compartmentalization vulnerability \[CWE-653\] in FortiClientMac…](https://agentprime.io/advisories/CVE-2024-35281.md)
  `CVE-2024-35281` · CVE record: Fortinet FortiClientMac and 1 more · CVSS 2.3 Low · Not analysed yet · Published 13 May 2025 · Tags: CWE-653
- [Process isolation bypass using "javascript:" URI links in cross-origin frames](https://agentprime.io/advisories/CVE-2025-4083.md)
  `CVE-2025-4083` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2025 · Tags: CWE-653
- [User in anonymous role could create and delete views](https://agentprime.io/advisories/CVE-2025-3086.md)
  `CVE-2025-3086` · CVE record: M-Files Corporation M-Files Server · CVSS 6.3 Medium · Not analysed yet · Published 4 Apr 2025 · Tags: CWE-653
- [ingress-nginx admission controller RCE escalation](https://agentprime.io/advisories/GHSA-mgvx-rpfc-9mpv.md)
  `GHSA-mgvx-rpfc-9mpv`, `CVE-2025-1974`, `GO-2025-3567` · Go `k8s.io/ingress-nginx`: affected `<1.11.5 || >=1.12.0-beta.0, <1.12.1`, fixed in `1.11.5`, `1.12.1` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.99 · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-653
- [Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD in github.com/metal3-io/baremetal-operator/apis](https://agentprime.io/advisories/GHSA-c98h-7hp9-v9hq.md)
  `GHSA-c98h-7hp9-v9hq`, `CVE-2025-29781`, `GO-2025-3530` · Go `github.com/metal3-io/baremetal-operator/apis`: affected `<0.8.1 || >=0.9.0, <0.9.1`, fixed in `0.8.1`, `0.9.1` · CVSS 6.5 Medium · Not analysed yet · Published 18 Mar 2025 · Tags: Information disclosure, CWE-653
- [SolarWinds Service Desk Broken Access Control Vulnerability](https://agentprime.io/advisories/CVE-2025-26393.md)
  `CVE-2025-26393` · CVE record: SolarWinds Service Desk · CVSS 5.4 Medium · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-653
- [Junos OS: An local attacker with shell access can execute arbitrary code](https://agentprime.io/advisories/CVE-2025-21590.md)
  `CVE-2025-21590` · CVE record: Juniper Networks Junos OS · CVSS 6.7 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-653
- [Azure PromptFlow remote code execution related to Jinja templates](https://agentprime.io/advisories/GHSA-gprr-v9f2-px3c.md)
  `GHSA-gprr-v9f2-px3c`, `CVE-2025-24986`, `PYSEC-2026-1804`, `PYSEC-2026-2968` · PyPI `promptflow-core` and 1 more: affected `<1.17.2`, fixed in `1.17.2` · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-653
- [lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell](https://agentprime.io/advisories/PYSEC-2025-127.md)
  `PYSEC-2025-127`, `CVE-2024-55456` · PyPI `lunasvg`: affected `<=3.0.1`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 3 Feb 2025 · Tags: CWE-653
- [NVIDIA Container Toolkit: NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially…](https://agentprime.io/advisories/CVE-2024-0137.md)
  `CVE-2024-0137` · CVE record: NVIDIA NVIDIA Container Toolkit and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-653
- [NVIDIA Container Toolkit: NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially…](https://agentprime.io/advisories/CVE-2024-0136.md)
  `CVE-2024-0136` · CVE record: NVIDIA NVIDIA Container Toolkit and 1 more · CVSS 7.6 High · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-653
- [NVIDIA Container Toolkit: NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially…](https://agentprime.io/advisories/CVE-2024-0135.md)
  `CVE-2024-0135` · CVE record: NVIDIA NVIDIA Container Toolkit and 1 more · CVSS 7.6 High · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-653
- [lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.](https://agentprime.io/advisories/PYSEC-2025-132.md)
  `PYSEC-2025-132`, `CVE-2024-57723` · PyPI `lunasvg`: affected `<=3.0.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-653
- [lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.](https://agentprime.io/advisories/PYSEC-2025-130.md)
  `PYSEC-2025-130`, `CVE-2024-57721` · PyPI `lunasvg`: affected `<=3.0.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-653
- [lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.](https://agentprime.io/advisories/PYSEC-2025-129.md)
  `PYSEC-2025-129`, `CVE-2024-57720` · PyPI `lunasvg`: affected `<=3.0.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-653
- [A user with advanced report application access rights can perform actions for which they are not authorized](https://agentprime.io/advisories/CVE-2024-47520.md)
  `CVE-2024-47520` · CVE record: Arista Networks Arista Edge Threat Management · CVSS 7.6 High · Not analysed yet · Published 10 Jan 2025 · Tags: CWE-653
- [The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator](https://agentprime.io/advisories/GHSA-pqfh-xh7w-7h3p.md)
  `GHSA-pqfh-xh7w-7h3p`, `CVE-2024-43803`, `GO-2024-3109` · Go `github.com/metal3-io/baremetal-operator`: affected `<0.5.2 || >=0.6.0, <0.6.2 || >=0.7.0-rc.0, <0.8.0`, fixed in `0.5.2`, `0.6.2`, `0.8.0` · CVSS 4.9 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: Information disclosure, CWE-653
- [User can view tickets from organizations they're not apart of in centurion_erp](https://agentprime.io/advisories/CVE-2024-53855.md)
  `CVE-2024-53855` · CVE record: nofusscomputing centurion_erp · CVSS 1.9 Low · Not analysed yet · Published 27 Nov 2024 · Tags: CWE-653
- [vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c.](https://agentprime.io/advisories/CVE-2024-35425.md)
  `CVE-2024-35425` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 8 Nov 2024 · Tags: CWE-653
- [Centurion ERP user can view projects from organizations they're not apart of](https://agentprime.io/advisories/CVE-2024-49373.md)
  `CVE-2024-49373` · CVE record: nofusscomputing centurion_erp · CVSS 4.1 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: CWE-653
- [Grafana alerting wrong permission on datasource rule write endpoint](https://agentprime.io/advisories/CVE-2024-8118.md)
  `CVE-2024-8118` · CVE record: Grafana Grafana · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-653
- [Cisco NX-OS Software Python Parser Escape Vulnerability](https://agentprime.io/advisories/CVE-2024-20285.md)
  `CVE-2024-20285` · CVE record: Cisco Cisco NX-OS Software · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2024 · Tags: CWE-653
- [IP Forwarding enabled in B&R Automation Runtime](https://agentprime.io/advisories/CVE-2024-5801.md)
  `CVE-2024-5801` · CVE record: B&R Industrial Automation Automation Runtime · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2024 · Tags: CWE-653, CWE-1188
- [lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.](https://agentprime.io/advisories/PYSEC-2024-285.md)
  `PYSEC-2024-285`, `CVE-2024-33768` · PyPI `lunasvg`: affected `<=2.3.9`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 May 2024 · Tags: CWE-653
- [Junos OS: QFX5000 Series and EX Series: Specific malformed LACP packets will cause flaps](https://agentprime.io/advisories/CVE-2024-30388.md)
  `CVE-2024-30388` · CVE record: Juniper Networks Junos OS · CVSS 7.1 High · Not analysed yet · Published 12 Apr 2024 · Tags: CWE-653
- [OpenStack Barbican information disclosure vulnerability](https://agentprime.io/advisories/GHSA-6rx9-c2rh-3qv4.md)
  `GHSA-6rx9-c2rh-3qv4`, `CVE-2023-1636`, `PYSEC-2026-1214` · PyPI `barbican`: affected `<=16.0.0`, no fixed version yet · CVSS 6.0 Medium · Not analysed yet · Published 24 Sept 2023 · Tags: CWE-653
- [yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.](https://agentprime.io/advisories/CVE-2023-29580.md)
  `CVE-2023-29580` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 12 Apr 2023 · Tags: CWE-653
- [Rapid7 InsightCloudSec box object access](https://agentprime.io/advisories/CVE-2023-1305.md)
  `CVE-2023-1305` · CVE record: Rapid7 InsightCloudSec · CVSS 8.1 High · Not analysed yet · Published 21 Mar 2023 · Tags: CWE-653
- [Class Loading Vulnerability in Artemis](https://agentprime.io/advisories/GHSA-227w-wv4j-67h4.md)
  `GHSA-227w-wv4j-67h4`, `CVE-2024-23682` · Maven `de.tum.in.ase:artemis-java-test-sandbox`: affected `<1.8.0`, fixed in `1.8.0` · CVSS 8.2 High · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-501, CWE-653
- [Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares](https://agentprime.io/advisories/GHSA-883x-6fch-6wjx.md)
  `GHSA-883x-6fch-6wjx`, `CVE-2024-23683` · Maven `de.tum.in.ase:artemis-java-test-sandbox`: affected `<1.7.6`, fixed in `1.7.6` · CVSS 8.2 High · Not analysed yet · Published 21 Jan 2022 · Tags: CWE-653

Newest: <https://agentprime.io/advisories/tag/cwe-653.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-653&cursor=WyIyMDI1LTA4LTEyVDE2OjU4OjE4LjM3NzAwMFoiLCJDVkUtMjAyNS0yMDEwOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-653/?cursor=WyIyMDI1LTA4LTEyVDE2OjU4OjE4LjM3NzAwMFoiLCJDVkUtMjAyNS0yMDEwOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.