# CWE-693. Every Advisory and CVE whose sources give the weakness CWE-693, newest first. ## Records, newest first (an older page) - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-10950.md) `CVE-2026-10950` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-10944.md) `CVE-2026-10944` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-693 - [Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths](https://agentprime.io/advisories/GHSA-2gcr-mfcq-wcc3.md) `GHSA-2gcr-mfcq-wcc3`, `CVE-2026-47676` · npm `hono`: affected `<4.12.21`, fixed in `4.12.21` · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: HTTP request smuggling, CWE-693 - [HCL iControl was affected by Missing Security Headers vulnerability.](https://agentprime.io/advisories/CVE-2025-52609.md) `CVE-2025-52609` · CVE record: HCL iControl · CVSS 3.7 Low · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-0097.md) `CVE-2026-0097` · CVE record: Google Android · CVSS 8.0 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-0087.md) `CVE-2026-0087` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-0077.md) `CVE-2026-0077` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-0045.md) `CVE-2026-0045` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-48652.md) `CVE-2025-48652` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-48649.md) `CVE-2025-48649` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-693 - [Aider-AI Aider Pre-commit Hook args.py protection mechanism](https://agentprime.io/advisories/CVE-2026-10174.md) `CVE-2026-10174` · CVE record: Aider-AI Aider · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: CWE-693 - [NodeVM network builtin exclusions bypass via internal \_http_client and \_http_server](https://agentprime.io/advisories/GHSA-r9pm-gxmw-wv6p.md) `GHSA-r9pm-gxmw-wv6p`, `CVE-2026-47139` · npm `vm2`: affected `<3.11.4`, fixed in `3.11.4` · CVSS 8.6 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-693 - [NodeVM builtin denylist bypass via process and inspector/promises allows host code execution](https://agentprime.io/advisories/GHSA-rp36-8xq3-r6c4.md) `GHSA-rp36-8xq3-r6c4`, `CVE-2026-47140` · npm `vm2`: affected `<3.11.4`, fixed in `3.11.4` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: CWE-693 - [vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain](https://agentprime.io/advisories/GHSA-c4cf-2hgv-2qv6.md) `GHSA-c4cf-2hgv-2qv6`, `CVE-2026-47209` · npm `vm2`: affected `<3.11.4`, fixed in `3.11.4` · CVSS 8.6 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-693 - [vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks](https://agentprime.io/advisories/GHSA-m5q2-4fm3-vfqp.md) `GHSA-m5q2-4fm3-vfqp`, `CVE-2026-47135` · npm `vm2`: affected `<3.11.4`, fixed in `3.11.4` · CVSS 8.7 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-693 - [vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter](https://agentprime.io/advisories/GHSA-q3fm-4wcw-g57x.md) `GHSA-q3fm-4wcw-g57x`, `CVE-2026-92962` · npm `vm2`: affected `<3.11.4`, fixed in `3.11.4` · CVSS 2.1 Low · Not analysed yet · Published 29 May 2026 · Tags: CWE-693 - [Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown](https://agentprime.io/advisories/CVE-2026-49316.md) `CVE-2026-49316` · CVE record: Indian Motorcycle Scout Bobber + Tech · CVSS 4.1 Medium · Not analysed yet · Published 29 May 2026 · Tags: CWE-440, CWE-693, CWE-754 - [Indian Scout Bobber 2025 WCM voltage-based shutdown](https://agentprime.io/advisories/CVE-2026-49325.md) `CVE-2026-49325` · CVE record: Indian Motorcycle Scout Bobber + Tech · CVSS 4.1 Medium · Not analysed yet · Published 29 May 2026 · Tags: CWE-693, CWE-754, CWE-1384 - [CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests](https://agentprime.io/advisories/GHSA-rw47-hm26-6wr7.md) `GHSA-rw47-hm26-6wr7`, `CVE-2026-44982`, `GO-2026-5641` · Go `github.com/crowdsecurity/crowdsec`: affected `>=1.5.0, <1.7.8`, fixed in `1.7.8` · CVSS 7.2 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-693 - [pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution](https://agentprime.io/advisories/CVE-2026-48792.md) `CVE-2026-48792` · CVE record: mcdope pam_usb · CVSS 4.4 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-390, CWE-693 - [OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion](https://agentprime.io/advisories/CVE-2026-45102.md) `CVE-2026-45102` · CVE record: OneUptime oneuptime · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: CWE-693 - [LiquidJS's \`{% render %}\` tag silently bypasses per-render \`ownPropertyOnly:true\` via \`Context.spawn()\`](https://agentprime.io/advisories/GHSA-9x9p-qf8f-mvjg.md) `GHSA-9x9p-qf8f-mvjg`, `CVE-2026-44646` · npm `liquidjs`: affected `<10.26.0`, fixed in `10.26.0` · CVSS 5.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-693 - [Lumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass](https://agentprime.io/advisories/CVE-2026-44451.md) `CVE-2026-44451` · CVE record: prolix-oc Lumiverse · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: CWE-693 - [Twig: Sandbox property and method bypass via object-destructuring assignment](https://agentprime.io/advisories/GHSA-mm6w-gr99-p3jj.md) `GHSA-mm6w-gr99-p3jj`, `CVE-2026-46639`, `PKSA-hgmw-wn4d-hpcy` · Packagist `twig/twig`: affected `>=3.24.0, <3.26.0`, fixed in `3.26.0` · CVSS 7.1 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-693 - [Twig: \`{% sandbox %}{% include %}\` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)](https://agentprime.io/advisories/GHSA-7fxw-r6jv-74c8.md) `GHSA-7fxw-r6jv-74c8`, `CVE-2026-46638`, `PKSA-3mcc-k66d-pydb` · Packagist `twig/twig`: affected `<3.26.0`, fixed in `3.26.0` · CVSS 6.0 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-693 - [Twig: \`template_from_string()\` escapes a SourcePolicy-driven sandbox via synthesized template name](https://agentprime.io/advisories/GHSA-24x9-r6q4-q93w.md) `GHSA-24x9-r6q4-q93w`, `CVE-2026-46634`, `PKSA-21g2-dzjv-sky5` · Packagist `twig/twig`: affected `>=3.9.0, <3.26.0`, fixed in `3.26.0` · CVSS 7.7 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-693 - [@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails](https://agentprime.io/advisories/GHSA-59f3-7227-wmh4.md) `GHSA-59f3-7227-wmh4`, `CVE-2026-82855` · npm `@hulumi/policies`: affected `<1.3.2`, fixed in `1.3.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: CWE-693 - [Klever-Go KVM read-only execution can commit contract delete and upgrade side effects](https://agentprime.io/advisories/GHSA-jc6w-wmfc-fh33.md) `GHSA-jc6w-wmfc-fh33`, `CVE-2026-46403`, `GO-2026-5461` · Go `github.com/klever-io/klever-go`: affected `<1.7.17`, fixed in `1.7.17` · CVSS 6.3 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-693 - [FORTIFY_SOURCE disabled](https://agentprime.io/advisories/CVE-2026-44071.md) `CVE-2026-44071` · CVE record: Netatalk Netatalk · CVSS 3.7 Low · Not analysed yet · Published 21 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-9116.md) `CVE-2026-9116` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-9115.md) `CVE-2026-9115` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-693 - [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-8969.md) `CVE-2026-8969` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-693 - [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-8962.md) `CVE-2026-8962` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-693 - [Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component](https://agentprime.io/advisories/CVE-2026-8959.md) `CVE-2026-8959` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Memory corruption, CWE-20, CWE-693 - [Information disclosure, sandbox escape in the Security: Process Sandboxing component](https://agentprime.io/advisories/CVE-2026-8958.md) `CVE-2026-8958` · CVE record: Mozilla Firefox and 1 more · CVSS 8.6 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, CWE-693 - [Sandbox escape in Firefox and Firefox Focus for Android](https://agentprime.io/advisories/CVE-2026-8945.md) `CVE-2026-8945` · CVE record: Mozilla Firefox · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-653, CWE-693 - [Formie: Pre-authenticated server-side template injection in Hidden fields](https://agentprime.io/advisories/GHSA-x7m9-mwc2-g6w2.md) `GHSA-x7m9-mwc2-g6w2`, `CVE-2026-45697`, `PKSA-snft-3cv8-v5p5` · Packagist `verbb/formie`: affected `<2.2.20 || >=3.0.0-beta.1, <3.1.24`, fixed in `2.2.20`, `3.1.24` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 May 2026 · Tags: Code injection, CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8585.md) `CVE-2026-8585` · CVE record: Google Chrome · CVSS 7.5 High · Not analysed yet · Published 14 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8583.md) `CVE-2026-8583` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8572.md) `CVE-2026-8572` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 14 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8571.md) `CVE-2026-8571` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 14 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8563.md) `CVE-2026-8563` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-693 - [Strapi Upload Plugin MIME Validation Bypass via Content API](https://agentprime.io/advisories/GHSA-pcw7-5633-82vv.md) `GHSA-pcw7-5633-82vv`, `CVE-2026-22707` · npm `@strapi/upload`: affected `<5.33.3`, fixed in `5.33.3` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: Unrestricted file upload, CWE-693 - [Protection mechanism failure in Zoom Communications Zoom Workplace](https://agentprime.io/advisories/CVE-2026-30904.md) `CVE-2026-30904` · CVE record: Zoom Communications Zoom Workplace · CVSS 1.8 Low · Not analysed yet · Published 13 May 2026 · Tags: CWE-693 - [Protection mechanism failure in AMD EPYC™ Series 9004 Processors and others](https://agentprime.io/advisories/CVE-2024-36315.md) `CVE-2024-36315` · CVE record: AMD AMD EPYC™ Series 9004 Processors and 4 more · CVSS 5.7 Medium · Not analysed yet · Published 13 May 2026 · Tags: CWE-693 - [Heym < 0.0.21 Sandbox Escape via Python Introspection](https://agentprime.io/advisories/CVE-2026-45227.md) `CVE-2026-45227` · CVE record: heymrun heym · CVSS 8.7 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-693 - [Sandbox escape in the Profile Backup component](https://agentprime.io/advisories/CVE-2026-8401.md) `CVE-2026-8401` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: CWE-653, CWE-693 - [Protection mechanism failure in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-43660.md) `CVE-2026-43660` · CVE record: Apple Safari and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Apple macOS](https://agentprime.io/advisories/CVE-2026-28914.md) `CVE-2026-28914` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-358, CWE-693 - [vm2 has access to \`VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL\`](https://agentprime.io/advisories/GHSA-2cm2-m3w5-gp2f.md) `GHSA-2cm2-m3w5-gp2f`, `CVE-2026-92963` · npm `vm2`: affected `<3.11.2`, fixed in `3.11.2` · CVSS 6.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-227, CWE-693 - [PromptHub: Authenticated SSRF via IPv6 filter bypass in \`POST /api/skills/fetch-remote\`](https://agentprime.io/advisories/CVE-2026-42261.md) `CVE-2026-42261` · CVE record: legeling PromptHub · CVSS 7.1 High · Not analysed yet · Published 8 May 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-693 - [vm2 NodeVM \`nesting: true\` bypasses \`require: false\` allowing sandbox escape and arbitrary OS command execution](https://agentprime.io/advisories/GHSA-8hg8-63c5-gwmx.md) `GHSA-8hg8-63c5-gwmx`, `CVE-2026-44007` · npm `vm2`: affected `<3.11.1`, fixed in `3.11.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Broken access control, CWE-693, CWE-1100 - [vm2's Transformer Fast-Path Bypass Exposes Internal State Variable](https://agentprime.io/advisories/GHSA-wp5r-2gw5-m7q7.md) `GHSA-wp5r-2gw5-m7q7`, `CVE-2026-44003` · npm `vm2`: affected `<3.11.0`, fixed in `3.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: CWE-693 - [vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary](https://agentprime.io/advisories/GHSA-mpf8-4hx2-7cjg.md) `GHSA-mpf8-4hx2-7cjg`, `CVE-2026-44000` · npm `vm2`: affected `<3.11.0`, fixed in `3.11.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2026 · Tags: Information disclosure, CWE-693 - [Kimai's Twig function config() leaks server-wide secrets (LDAP bind password, SAML SP private key) via invoice/export templates](https://agentprime.io/advisories/GHSA-vrqv-52x7-rm4v.md) `GHSA-vrqv-52x7-rm4v`, `CVE-2026-80198`, `PKSA-zy2k-4hm5-25gd` · Packagist `kimai/kimai`: affected `<2.56.0`, fixed in `2.56.0` · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8018.md) `CVE-2026-8018` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8014.md) `CVE-2026-8014` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8011.md) `CVE-2026-8011` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8009.md) `CVE-2026-8009` · CVE record: Google Chrome · CVSS 5.0 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-8004.md) `CVE-2026-8004` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-693 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .