# CWE-693.

Every Advisory and CVE whose sources give the weakness CWE-693, newest first.

## Records, newest first (an older page)

- [Cisco IOS XR Software Security Hardening Release: September 2026](https://agentprime.io/advisories/CVE-2026-20277.md)
  `CVE-2026-20277` · CVE record: Cisco Cisco IOS XR Software · CVSS 8.2 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-693
- [Protection mechanism failure in Dell PowerStore 500T and others](https://agentprime.io/advisories/CVE-2026-79686.md)
  `CVE-2026-79686` · CVE record: Dell PowerStore 500T and 4 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-693
- [Protection mechanism failure in Dell PowerStore 500T and others](https://agentprime.io/advisories/CVE-2026-79684.md)
  `CVE-2026-79684` · CVE record: Dell PowerStore 500T and 4 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-693
- [Protection mechanism failure in Dell PowerStore 500T and others](https://agentprime.io/advisories/CVE-2026-79683.md)
  `CVE-2026-79683` · CVE record: Dell PowerStore 500T and 4 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-693
- [Sudo through 1.9.17p2 Intercept Policy Bypass via execveat](https://agentprime.io/advisories/CVE-2026-82474.md)
  `CVE-2026-82474` · CVE record: sudo-project sudo · CVSS 8.5 High · Not analysed yet · Published 29 Aug 2026 · Tags: CWE-693
- [Sandbox Escape in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-6876.md)
  `CVE-2026-6876` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: Code injection, CWE-693, CWE-1284
- [Spring Security InetAddressMatchers Incomplete Internal Network Classification](https://agentprime.io/advisories/CVE-2026-59277.md)
  `CVE-2026-59277` · CVE record: Spring Spring Security · CVSS 3.7 Low · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-693
- [Authenticated RCE through Twig sandbox escape](https://agentprime.io/advisories/CVE-2026-79988.md)
  `CVE-2026-79988` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-693
- [Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)](https://agentprime.io/advisories/CVE-2026-61792.md)
  `CVE-2026-61792` · CVE record: WeblateOrg weblate · CVSS 7.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal, CWE-693
- [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-79006.md)
  `CVE-2026-79006` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-43670.md)
  `CVE-2026-43670` · CVE record: Apple Safari and 2 more · CVSS 8.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in NVIDIA DGX Spark](https://agentprime.io/advisories/CVE-2026-47624.md)
  `CVE-2026-47624` · CVE record: NVIDIA DGX Spark · CVSS 6.0 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-693
- [mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server](https://agentprime.io/advisories/GHSA-xm98-3vcf-fph7.md)
  `GHSA-xm98-3vcf-fph7`, `CVE-2026-53710`, `PYSEC-2026-3862` · PyPI `mcp-contextforge-gateway`: affected `<1.0.2`, fixed in `1.0.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection, CWE-693
- [VeraCrypt: Hidden volume quick format weakens plausible deniability](https://agentprime.io/advisories/CVE-2026-54073.md)
  `CVE-2026-54073` · CVE record: veracrypt VeraCrypt · CVSS 4.6 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-693
- [Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)](https://agentprime.io/advisories/GHSA-8cfw-pcwh-v63w.md)
  `GHSA-8cfw-pcwh-v63w`, `CVE-2026-79774`, `PKSA-wtw3-z7vh-tcrk` · Packagist `winter/wn-system-module`: affected `>=1.2.7, <1.2.13`, fixed in `1.2.13` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-693
- [asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter](https://agentprime.io/advisories/GHSA-9w56-46f6-3qhx.md)
  `GHSA-9w56-46f6-3qhx`, `CVE-2026-102734` · PyPI `asteval`: affected `<1.0.9`, fixed in `1.0.9` · CVSS 5.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-693, CWE-749, CWE-913
- [Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)](https://agentprime.io/advisories/CVE-2026-76827.md)
  `CVE-2026-76827` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-693
- [Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer](https://agentprime.io/advisories/CVE-2026-52873.md)
  `CVE-2026-52873` · CVE record: truelockmc streambert · CVSS 6.9 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-693
- [Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app](https://agentprime.io/advisories/CVE-2026-45733.md)
  `CVE-2026-45733` · CVE record: TriliumNext Trilium · CVSS 8.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-693
- [Mitigation bypass in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2026-74938.md)
  `CVE-2026-74938` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Sandbox escape in the Remote Settings Client component](https://agentprime.io/advisories/CVE-2026-75874.md)
  `CVE-2026-75874` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Mitigation bypass in the Data Loss Prevention component](https://agentprime.io/advisories/CVE-2026-74983.md)
  `CVE-2026-74983` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Mitigation bypass in the Storage: Cache API component](https://agentprime.io/advisories/CVE-2026-74959.md)
  `CVE-2026-74959` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Mitigation bypass in the Safe Browsing component](https://agentprime.io/advisories/CVE-2026-74957.md)
  `CVE-2026-74957` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65339.md)
  `CVE-2026-65339` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-693
- [Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution](https://agentprime.io/advisories/CVE-2026-71858.md)
  `CVE-2026-71858` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 5.4 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection, CWE-345, CWE-693
- [VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE](https://agentprime.io/advisories/GHSA-m283-3h24-438v.md)
  `GHSA-m283-3h24-438v`, `CVE-2026-47686` · npm `vm2`: affected `<3.11.6`, fixed in `3.11.6` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-693
- [openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can us...](https://agentprime.io/advisories/GHSA-w7gr-9g4g-33mx.md)
  `GHSA-w7gr-9g4g-33mx`, `CVE-2026-74896`, `PYSEC-2026-3771` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-693
- [openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access...](https://agentprime.io/advisories/GHSA-623h-chj7-hfx8.md)
  `GHSA-623h-chj7-hfx8`, `CVE-2026-74895`, `PYSEC-2026-3770` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-693
- [openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can ...](https://agentprime.io/advisories/GHSA-mcjj-qw7m-j3cp.md)
  `GHSA-mcjj-qw7m-j3cp`, `CVE-2026-74883`, `PYSEC-2026-3760` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-693
- [IBM Db2 Mirror for i is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-17079.md)
  `CVE-2026-17079` · CVE record: IBM Db2 Mirror for i · CVSS 6.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-693
- [SQL Query Validation Bypass in OpenSearch Direct Query](https://agentprime.io/advisories/CVE-2026-18428.md)
  `CVE-2026-18428` · CVE record: AWS Opensearch and 1 more · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-693
- [Prisma Access Agent: Anti-Tamper Protection Bypass on Windows](https://agentprime.io/advisories/CVE-2026-0293.md)
  `CVE-2026-0293` · CVE record: Palo Alto Networks Prisma Access Agent · CVSS 5.6 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-693
- [RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted](https://agentprime.io/advisories/CVE-2026-73288.md)
  `CVE-2026-73288` · CVE record: rustfs rustfs · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-693, CWE-754
- [CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed from these locations.](https://agentprime.io/advisories/CVE-2025-59326.md)
  `CVE-2025-59326` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-693
- [Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-9mrh-pw7c-9mqm.md)
  `GHSA-9mrh-pw7c-9mqm`, `BIT-dotnet-2026-62902`, `BIT-dotnet-sdk-2026-62902`, `CVE-2026-62902` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11`, fixed in `8.0.30`, `9.0.19`, `10.0.11` · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-693, CWE-829
- [Cursor: Sandbox escape via tampered Python virtual environments](https://agentprime.io/advisories/CVE-2026-73217.md)
  `CVE-2026-73217` · CVE record: cursor cursor · CVSS 7.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Visual Studio Code Python Extension Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-54981.md)
  `CVE-2026-54981` · CVE record: Microsoft Python extension for Visual Studio Code · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693, CWE-829
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69278.md)
  `CVE-2026-69278` · CVE record: Microsoft Visual Studio Code · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control, CWE-693
- [Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading](https://agentprime.io/advisories/CVE-2026-73083.md)
  `CVE-2026-73083` · CVE record: activepieces activepieces · CVSS 7.6 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) Transfer Learning Tool](https://agentprime.io/advisories/CVE-2026-39452.md)
  `CVE-2026-39452` · CVE record: Intel(R) Transfer Learning Tool · CVSS 6.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) Workload Services Framework software](https://agentprime.io/advisories/CVE-2026-28757.md)
  `CVE-2026-28757` · CVE record: Intel(R) Workload Services Framework software · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in LLM-on-Ray](https://agentprime.io/advisories/CVE-2026-28707.md)
  `CVE-2026-28707` · CVE record: LLM-on-Ray · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) oneCCL Bindings for PyTorch](https://agentprime.io/advisories/CVE-2026-24693.md)
  `CVE-2026-24693` · CVE record: Intel(R) oneCCL Bindings for PyTorch · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) AI Reference Models](https://agentprime.io/advisories/CVE-2026-21400.md)
  `CVE-2026-21400` · CVE record: Intel(R) AI Reference Models · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) LLM Library for PyTorch](https://agentprime.io/advisories/CVE-2026-21387.md)
  `CVE-2026-21387` · CVE record: Intel(R) LLM Library for PyTorch · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) Neural Compressor software](https://agentprime.io/advisories/CVE-2026-20906.md)
  `CVE-2026-20906` · CVE record: Intel(R) Neural Compressor software · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) AI Containers](https://agentprime.io/advisories/CVE-2026-20903.md)
  `CVE-2026-20903` · CVE record: Intel(R) AI Containers · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Cluster Management Toolkit for Kubernetes software](https://agentprime.io/advisories/CVE-2026-20770.md)
  `CVE-2026-20770` · CVE record: Cluster Management Toolkit for Kubernetes software · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in LLM Scaler software](https://agentprime.io/advisories/CVE-2026-20755.md)
  `CVE-2026-20755` · CVE record: LLM Scaler software · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel Extension for TensorFlow software](https://agentprime.io/advisories/CVE-2026-20728.md)
  `CVE-2026-20728` · CVE record: Intel Extension for TensorFlow software · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow…](https://agentprime.io/advisories/CVE-2026-20702.md)
  `CVE-2026-20702` · CVE record: Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts. · CVSS 8.9 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape](https://agentprime.io/advisories/GHSA-h784-hpjp-2rrm.md)
  `GHSA-h784-hpjp-2rrm` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1`, no fixed version yet · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-693
- [Craft CMS: Authenticated RCE through Twig sandbox escape](https://agentprime.io/advisories/GHSA-f5wm-88jv-g5hx.md)
  `GHSA-f5wm-88jv-g5hx`, `CVE-2026-72781`, `PKSA-d48x-nyby-nphv` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.18.3 || >=5.0.0-RC1, <5.10.7`, fixed in `4.18.3`, `5.10.7` · CVSS 8.7 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-19152.md)
  `CVE-2026-19152` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-19150.md)
  `CVE-2026-19150` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-19168.md)
  `CVE-2026-19168` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693
- [Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password](https://agentprime.io/advisories/CVE-2026-13342.md)
  `CVE-2026-13342` · CVE record: Unknown Security Optimizer · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693
- [Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products](https://agentprime.io/advisories/CVE-2025-15039.md)
  `CVE-2025-15039` · CVE record: WSO2 WSO2 Identity Server and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693
- [Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks](https://agentprime.io/advisories/CVE-2024-6832.md)
  `CVE-2024-6832` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-693

Newest: <https://agentprime.io/advisories/tag/cwe-693.md>
Older: <https://agentprime.io/advisories/tag/cwe-693.md?cursor=WyIyMDI2LTA4LTA2VDA3OjMyOjU5LjI1NjAwMFoiLCJDVkUtMjAyNC02ODMyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-693&cursor=WyIyMDI2LTA5LTAyVDE2OjU5OjQ4LjgwMDAwMFoiLCJDVkUtMjAyNi04NDgwOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-693/?cursor=WyIyMDI2LTA5LTAyVDE2OjU5OjQ4LjgwMDAwMFoiLCJDVkUtMjAyNi04NDgwOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.