# CWE-693. Every Advisory and CVE whose sources give the weakness CWE-693, newest first. ## Records, newest first (an older page) - [Windows Event Logging Service Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-34348.md) `CVE-2026-34348` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-693 - [mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism](https://agentprime.io/advisories/CVE-2026-15618.md) `CVE-2026-15618` · CVE record: mosaxiv clawlet · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: CWE-693 - [lamaalrajih kicad-mcp path_validator.py protection mechanism](https://agentprime.io/advisories/CVE-2026-15528.md) `CVE-2026-15528` · CVE record: lamaalrajih kicad-mcp · CVSS 4.8 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: CWE-693 - [SafeInstall agent guard shell parsing can miss raw package execution](https://agentprime.io/advisories/GHSA-xrmc-c5cg-rv7x.md) `GHSA-xrmc-c5cg-rv7x` · npm `safeinstall-cli`: affected `<0.10.2`, fixed in `0.10.2` · CVSS 8.8 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-178, CWE-693 - [Duplicate Advisory: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow](https://agentprime.io/advisories/GHSA-c6pq-cprj-62fw.md) `GHSA-c6pq-cprj-62fw` · PyPI `praisonaiagents`: affected `<=1.6.77`, no fixed version yet · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-693 - [Duplicate Advisory: PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked](https://agentprime.io/advisories/GHSA-5c3v-h6hw-4gx7.md) `GHSA-5c3v-h6hw-4gx7` · PyPI `praisonai`: affected `<=4.6.77`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-693 - [SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace](https://agentprime.io/advisories/CVE-2026-59854.md) `CVE-2026-59854` · CVE record: siyuan-note siyuan · CVSS 4.9 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-693 - [Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows](https://agentprime.io/advisories/CVE-2026-0278.md) `CVE-2026-0278` · CVE record: Palo Alto Networks Prisma Access Agent · CVSS 5.8 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-693 - [oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)](https://agentprime.io/advisories/GHSA-2jcc-mxv7-p3f9.md) `GHSA-2jcc-mxv7-p3f9`, `CVE-2026-53508`, `GO-2026-5937` · Go `github.com/oasdiff/oasdiff`: affected `>=1.13.2, <1.18.1`, fixed in `1.18.1` · CVSS 6.0 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-693 - [netfoil has a domain name filter bypass via multiple questions](https://agentprime.io/advisories/GHSA-59qp-cfj3-rp64.md) `GHSA-59qp-cfj3-rp64`, `GO-2026-5934` · Go `github.com/tinfoil-factory/netfoil`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 4.0, no score published · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-436, CWE-693 - [uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)](https://agentprime.io/advisories/GHSA-fqf6-gxhh-2xhw.md) `GHSA-fqf6-gxhh-2xhw` · crates.io `uucore`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-440, CWE-693 - [rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection](https://agentprime.io/advisories/GHSA-89p7-7cq3-hhr2.md) `GHSA-89p7-7cq3-hhr2`, `CVE-2026-35363` · crates.io `uu_rm`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 5.6 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Path traversal, CWE-693 - [rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)](https://agentprime.io/advisories/GHSA-7cr3-h577-g38j.md) `GHSA-7cr3-h577-g38j`, `CVE-2026-35349` · crates.io `uu_rm`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 6.7 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Path traversal, CWE-693 - [In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardles...](https://agentprime.io/advisories/GHSA-cffv-grgg-g429.md) `GHSA-cffv-grgg-g429`, `CVE-2026-14535`, `PYSEC-2026-2150` · PyPI `fickling`: affected `<0.1.12`, fixed in `0.1.12` · CVSS 8.8 High · Not analysed yet · Published 4 Jul 2026 · Tags: CWE-693 - [NousResearch hermes-agent server.py shell.exec protection mechanism](https://agentprime.io/advisories/CVE-2026-14625.md) `CVE-2026-14625` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: CWE-693 - [Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records](https://agentprime.io/advisories/CVE-2026-14440.md) `CVE-2026-14440` · CVE record: Cloudflare Universal SSL · CVSS 7.6 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14409.md) `CVE-2026-14409` · CVE record: Google Chrome · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-693 - [Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached \`Template\`](https://agentprime.io/advisories/GHSA-529h-vh3j-85hq.md) `GHSA-529h-vh3j-85hq`, `CVE-2026-46636`, `CVE-2026-49981`, `PKSA-8zx5-v2nz-58pb` · Packagist `twig/twig`: affected `<3.27.0`, fixed in `3.27.0` · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control, Code injection, CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14151.md) `CVE-2026-14151` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14120.md) `CVE-2026-14120` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14101.md) `CVE-2026-14101` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14097.md) `CVE-2026-14097` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14092.md) `CVE-2026-14092` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14076.md) `CVE-2026-14076` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14059.md) `CVE-2026-14059` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14058.md) `CVE-2026-14058` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14050.md) `CVE-2026-14050` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14037.md) `CVE-2026-14037` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-14017.md) `CVE-2026-14017` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13951.md) `CVE-2026-13951` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13910.md) `CVE-2026-13910` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13909.md) `CVE-2026-13909` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13904.md) `CVE-2026-13904` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13886.md) `CVE-2026-13886` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13876.md) `CVE-2026-13876` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13862.md) `CVE-2026-13862` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-13859.md) `CVE-2026-13859` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Twig: Sandbox property allowlist bypass via the \`column\` filter under \`SourcePolicyInterface\`](https://agentprime.io/advisories/GHSA-h8vq-8gpg-mhcg.md) `GHSA-h8vq-8gpg-mhcg`, `CVE-2026-48808`, `PKSA-fbvq-z33h-r2np` · Packagist `twig/twig`: affected `<3.27.0`, fixed in `3.27.0` · CVSS 6.0 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control, CWE-693 - [Twig: Sandbox \`\_\_toString()\` policy bypass via \`Traversable\` in \`join\` and \`replace\` filters](https://agentprime.io/advisories/GHSA-8x9c-rmqh-456c.md) `GHSA-8x9c-rmqh-456c`, `CVE-2026-48807`, `PKSA-xx6c-6d96-db2w` · Packagist `twig/twig`: affected `<3.27.0`, fixed in `3.27.0` · CVSS 7.1 High · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control, CWE-693 - [Twig: Sandbox \`\_\_toString()\` policy bypass via dynamic mapping keys](https://agentprime.io/advisories/GHSA-5v5v-ww74-355v.md) `GHSA-5v5v-ww74-355v`, `CVE-2026-48806`, `PKSA-1tmc-rt7x-12w6` · Packagist `twig/twig`: affected `<3.27.0`, fixed in `3.27.0` · CVSS 7.1 High · Not analysed yet · Published 30 Jun 2026 · Tags: Broken access control, CWE-693 - [Twig: Sandbox state regression in deprecated internal wrappers in \`src/Resources/core.php\`](https://agentprime.io/advisories/GHSA-p42q-9prx-q5wq.md) `GHSA-p42q-9prx-q5wq`, `CVE-2026-48805`, `PKSA-g9zw-qxh8-pq8w` · Packagist `twig/twig`: affected `<3.27.0`, fixed in `3.27.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-693 - [Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape](https://agentprime.io/advisories/GHSA-gx55-f84r-v3r7.md) `GHSA-gx55-f84r-v3r7`, `CVE-2026-50564`, `GO-2026-5855` · Go `github.com/fission/fission`: affected `<1.24.0`, fixed in `1.24.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Privilege escalation, Broken access control, CWE-693 - [Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover](https://agentprime.io/advisories/GHSA-wmgg-3p4h-48x7.md) `GHSA-wmgg-3p4h-48x7`, `CVE-2026-50545`, `GO-2026-5860` · Go `github.com/fission/fission`: affected `<1.24.0`, fixed in `1.24.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Privilege escalation, Broken access control, CWE-693 - [OpenAM Authenticated RCE via Groovy Sandbox Escape](https://agentprime.io/advisories/GHSA-69j4-qvqr-hpw3.md) `GHSA-69j4-qvqr-hpw3`, `CVE-2026-47424` · Maven `org.openidentityplatform.openam:openam-scripting`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.5 High · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-693 - [PraisonAI vulnerable to sandbox escape via \`print.\_\_self\_\_\` builtins module leak in \`execute_code\` (subprocess mode)](https://agentprime.io/advisories/GHSA-4mr5-g6f9-cfrh.md) `GHSA-4mr5-g6f9-cfrh`, `CVE-2026-47392`, `PYSEC-2026-463`, `PYSEC-2026-483` · PyPI `praisonai`: affected `<4.6.40`, fixed in `4.6.40` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-184, CWE-693 - [PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code](https://agentprime.io/advisories/GHSA-6vh2-h83c-9294.md) `GHSA-6vh2-h83c-9294`, `CVE-2026-34938`, `PYSEC-2026-484` · PyPI `praisonaiagents`: affected `<1.5.90`, fixed in `1.5.90` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-693 - [PraisonAI has sandbox escape via exception frame traversal in \`execute_code\` (subprocess mode)](https://agentprime.io/advisories/GHSA-qf73-2hrx-xprp.md) `GHSA-qf73-2hrx-xprp`, `CVE-2026-39888`, `PYSEC-2026-486` · PyPI `praisonaiagents`: affected `<1.5.115`, fixed in `1.5.115` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-657, CWE-693 - [Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications](https://agentprime.io/advisories/CVE-2026-13601.md) `CVE-2026-13601` · CVE record: Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support and 4 more · CVSS 7.1 High · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-693 - [7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision](https://agentprime.io/advisories/CVE-2026-58052.md) `CVE-2026-58052` · CVE record: 7-Zip 7-Zip · CVSS 4.8 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: CWE-693 - [pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle](https://agentprime.io/advisories/GHSA-5wx6-mg75-v57r.md) `GHSA-5wx6-mg75-v57r`, `CVE-2026-55487` · npm `pnpm`: affected `<10.34.2 || >=11.0.0, <11.5.3`, fixed in `10.34.2`, `11.5.3` · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-346, CWE-693, CWE-829 - [nono-py has proxy-only network fallback bypass on older Linux kernels](https://agentprime.io/advisories/GHSA-72w7-mf9g-733p.md) `GHSA-72w7-mf9g-733p` · PyPI `nono-py`: affected `>=0.9.0, <0.10.1`, fixed in `0.10.1` · CVSS 6.4 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-693 - [Markdown image rendering bypass in AI bot tool result posts in Mattermost](https://agentprime.io/advisories/CVE-2026-3472.md) `CVE-2026-3472` · CVE record: Mattermost Mattermost · CVSS 3.5 Low · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-693 - [Warp: Env-var prefixes can lead to denylisted command autoexecution](https://agentprime.io/advisories/CVE-2026-48721.md) `CVE-2026-48721` · CVE record: warpdotdev warp · CVSS 8.6 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-180, CWE-693 - [Jenkins Script Security Plugin has a script security bypass vulnerability](https://agentprime.io/advisories/GHSA-cfj9-2vgr-hpxp.md) `GHSA-cfj9-2vgr-hpxp`, `CVE-2026-57281` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1402.1405.vc96e74964250`, fixed in `1402.1405.vc96e74964250` · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2026 · Tags: Other injection, Code injection, CWE-693 - [Jenkins Script Security Plugin sandbox bypass vulnerability](https://agentprime.io/advisories/GHSA-c3jm-9vj7-5v66.md) `GHSA-c3jm-9vj7-5v66`, `CVE-2026-57280` · Maven `org.jenkins-ci.plugins:script-security`: affected `<1402.1405.vc96e74964250`, fixed in `1402.1405.vc96e74964250` · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-693 - [Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails](https://agentprime.io/advisories/GHSA-4mr2-fg2p-w63c.md) `GHSA-4mr2-fg2p-w63c`, `CVE-2026-54762`, `GO-2026-5128` · Go `github.com/traefik/traefik/v3`: affected `>=3.7.0-ea.1, <3.7.5`, fixed in `3.7.5` · CVSS 5.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-636, CWE-693 - [OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns](https://agentprime.io/advisories/GHSA-v2ww-5rh7-2h5v.md) `GHSA-v2ww-5rh7-2h5v`, `CVE-2026-53853` · npm `openclaw`: affected `<2026.5.12`, fixed in `2026.5.12` · CVSS 7.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: Broken access control, CWE-693 - [OpenClaw: Skill-command dispatch could skip before-tool-call hooks](https://agentprime.io/advisories/GHSA-68xw-r643-9p5w.md) `GHSA-68xw-r643-9p5w`, `CVE-2026-53845` · npm `openclaw`: affected `<2026.5.6`, fixed in `2026.5.6` · CVSS 2.3 Low · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-693 - [PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable](https://agentprime.io/advisories/GHSA-6jcq-6546-qrrw.md) `GHSA-6jcq-6546-qrrw`, `CVE-2026-57144`, `PYSEC-2026-3504` · PyPI `praisonai`: affected `>=4.5.110, <4.6.61`, fixed in `4.6.61` · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation, Information disclosure, CWE-693 - [npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining](https://agentprime.io/advisories/GHSA-5jv7-2mjm-h6qj.md) `GHSA-5jv7-2mjm-h6qj`, `CVE-2026-57133` · npm `praisonai`: affected `>=1.5.1, <1.7.2`, fixed in `1.7.2` · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Command injection, Broken access control, CWE-693 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .