# CWE-693.

Every Advisory and CVE whose sources give the weakness CWE-693, newest first.

## Records, newest first (an older page)

- [kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy](https://agentprime.io/advisories/GHSA-x442-m7cc-hr92.md)
  `GHSA-x442-m7cc-hr92` · crates.io `kora-lib`: affected `<2.0.5`, fixed in `2.0.5` · CVSS 4.0, no score published · Not analysed yet · Published 12 Mar 2026 · Tags: CWE-693
- [@whyour/qinglong: manipulation of the argument command leads to protection mechanism failure](https://agentprime.io/advisories/GHSA-xj37-qjg2-xwv2.md)
  `GHSA-xj37-qjg2-xwv2`, `CVE-2026-3965` · npm `@whyour/qinglong`: affected `<2.20.2`, fixed in `2.20.2` · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-0118.md)
  `CVE-2026-0118` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-693
- [Parse Server has denylist \`requestKeywordDenylist\` keyword scan bypass through nested object placement](https://agentprime.io/advisories/GHSA-q342-9w2p-57fp.md)
  `GHSA-q342-9w2p-57fp`, `BIT-parse-2026-30938`, `CVE-2026-30938` · npm `parse-server`: affected `<8.6.12 || >=9.0.0-alpha.1, <9.5.1-alpha.1`, fixed in `8.6.12`, `9.5.1-alpha.1` · CVSS 6.9 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-693
- [OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions](https://agentprime.io/advisories/GHSA-9q36-67vc-rrwg.md)
  `GHSA-9q36-67vc-rrwg`, `CVE-2026-27646` · npm `openclaw`: affected `<2026.3.7`, fixed in `2026.3.7` · CVSS 5.8 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Broken access control, CWE-693
- [Cloudfoundry UAA has logic error in the token revocation endpoint implementation](https://agentprime.io/advisories/GHSA-6wcw-r64p-qrrw.md)
  `GHSA-6wcw-r64p-qrrw`, `CVE-2026-22723` · Maven `org.cloudfoundry.identity:cloudfoundry-identity-server`: affected `>=77.30.0, <78.8.0`, fixed in `78.8.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-640, CWE-693
- [Fickling has \`always_check_safety()\` bypass: pickle.loads and \_pickle.loads remain unhooked](https://agentprime.io/advisories/GHSA-wccx-j62j-r448.md)
  `GHSA-wccx-j62j-r448` · PyPI `fickling`: affected `<0.1.9`, fixed in `0.1.9` · CVSS 4.0, no score published · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-693
- [OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode](https://agentprime.io/advisories/GHSA-8mf7-vv8w-hjr2.md)
  `GHSA-8mf7-vv8w-hjr2` · npm `openclaw`: affected `<2026.2.22`, fixed in `2026.2.22` · CVSS 4.0, no score published · Not analysed yet · Published 3 Mar 2026 · Tags: Command injection, CWE-693
- [PickleScan has multiple stdlib modules with direct RCE not in blocklist](https://agentprime.io/advisories/GHSA-g38g-8gr9-h9xp.md)
  `GHSA-g38g-8gr9-h9xp`, `CVE-2026-56315`, `PYSEC-2026-4134` · PyPI `picklescan`: affected `<1.0.4`, fixed in `1.0.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-184, CWE-693
- [OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container](https://agentprime.io/advisories/GHSA-43x4-g22p-3hrq.md)
  `GHSA-43x4-g22p-3hrq`, `CVE-2026-32046` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-693, CWE-1188
- [An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to perform Administrative actions using servic…](https://agentprime.io/advisories/CVE-2024-55024.md)
  `CVE-2024-55024` · CVE record · CVSS 8.8 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-693
- [OpenClaw has a sandbox network isolation bypass via docker.network=container:\<id>](https://agentprime.io/advisories/GHSA-ww6v-v748-x7g9.md)
  `GHSA-ww6v-v748-x7g9`, `CVE-2026-32038` · npm `openclaw`: affected `<2026.2.24`, fixed in `2026.2.24` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: Broken access control, CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2024-31328.md)
  `CVE-2024-31328` · CVE record: Google Android · CVSS 8.8 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-0017.md)
  `CVE-2026-0017` · CVE record: Google Android · CVSS 7.7 High · Not analysed yet · Published 2 Mar 2026 · Tags: Broken access control, CWE-693
- [Improper access control in Google Android](https://agentprime.io/advisories/CVE-2026-0012.md)
  `CVE-2026-0012` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Broken access control, CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-0011.md)
  `CVE-2026-0011` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-693, CWE-703
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-48653.md)
  `CVE-2025-48653` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-48635.md)
  `CVE-2025-48635` · CVE record: Google Android · CVSS 7.7 High · Not analysed yet · Published 2 Mar 2026 · Tags: Information disclosure, CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-48605.md)
  `CVE-2025-48605` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-48602.md)
  `CVE-2025-48602` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-693
- [Lack of HTTP Response Headers](https://agentprime.io/advisories/CVE-2025-58406.md)
  `CVE-2025-58406` · CVE record: CGM CGM CLININET · CVSS 5.3 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-693
- [n8n has a Guardrail Node Bypass](https://agentprime.io/advisories/GHSA-fvfv-ppw4-7h2w.md)
  `GHSA-fvfv-ppw4-7h2w`, `CVE-2026-56349` · npm `n8n`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 6.3 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-20, CWE-693
- [Information disclosure, mitigation bypass in the Settings UI component](https://agentprime.io/advisories/CVE-2026-2803.md)
  `CVE-2026-2803` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2026 · Tags: Information disclosure, CWE-693
- [Sandbox escape in the Storage: IndexedDB component](https://agentprime.io/advisories/CVE-2026-2768.md)
  `CVE-2026-2768` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: Broken access control, CWE-693
- [Sandbox escape in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-2761.md)
  `CVE-2026-2761` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-693
- [Protection mechanism failure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2025-46290.md)
  `CVE-2025-46290` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 7.5 High · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-693, CWE-703
- [Protection mechanism failure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-20667.md)
  `CVE-2026-20667` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-693
- [Windows Shell Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-21510.md)
  `CVE-2026-21510` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.61 · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-693
- [MSHTML Framework Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-21513.md)
  `CVE-2026-21513` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.16 · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-693
- [n8n has a Python sandbox escape](https://agentprime.io/advisories/GHSA-8398-gmmx-564h.md)
  `GHSA-8398-gmmx-564h`, `CVE-2026-25115` · npm `n8n`: affected `<2.4.8`, fixed in `2.4.8` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2026 · Tags: CWE-693
- [n8n Merge Node has Arbitrary File Write leading to RCE](https://agentprime.io/advisories/GHSA-hv53-3329-vmrm.md)
  `GHSA-hv53-3329-vmrm`, `CVE-2026-25056` · npm `n8n`: affected `<1.118.0 || >=2.0.0, <2.4.0`, fixed in `1.118.0`, `2.4.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2026 · Tags: Unrestricted file upload, CWE-693
- [L2TP over IPSec Encryption Failure on ArcherAXE75](https://agentprime.io/advisories/CVE-2026-0620.md)
  `CVE-2026-0620` · CVE record: TP-Link Systems Inc. AXE75 · CVSS 6.0 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-693
- [Anti-Tamper Bypass in BeyondTrust Privilege Management for Windows](https://agentprime.io/advisories/CVE-2026-1232.md)
  `CVE-2026-1232` · CVE record: BeyondTrust Privilege management for Windows · CVSS 6.8 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-693
- [TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/GHSA-gpx9-96j6-pp87.md)
  `GHSA-gpx9-96j6-pp87` · PyPI `agentos-taskweaver`: affected `<=0.1.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Server-side request forgery (SSRF), CWE-693
- [x86: incomplete IBPB for vCPU isolation](https://agentprime.io/advisories/CVE-2026-23553.md)
  `CVE-2026-23553` · CVE record: Xen Xen · CVSS 2.9 Low · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-665, CWE-693
- [SolarWinds Web Help Desk Security Control Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-40536.md)
  `CVE-2025-40536` · CVE record: SolarWinds Web Help Desk · CVSS 8.1 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.74 · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-693
- [SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor](https://agentprime.io/advisories/GHSA-wxhw-j4hc-fmq6.md)
  `GHSA-wxhw-j4hc-fmq6`, `CVE-2026-23830` · npm `@nyariv/sandboxjs`: affected `<0.8.26`, fixed in `0.8.26` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection, CWE-693, CWE-913
- [Mitigation bypass in the Privacy: Anti-Tracking component](https://agentprime.io/advisories/CVE-2026-24868.md)
  `CVE-2026-24868` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-693
- [vm2 has a Sandbox Escape](https://agentprime.io/advisories/GHSA-99p7-6v5w-7xg8.md)
  `GHSA-99p7-6v5w-7xg8`, `CVE-2026-22709` · npm `vm2`: affected `<3.10.2`, fixed in `3.10.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: Code injection, CWE-693, CWE-913
- [HCL AION is affected by a Missing Security Response Headers vulnerability.](https://agentprime.io/advisories/CVE-2025-55249.md)
  `CVE-2025-55249` · CVE record: HCL Software AION · CVSS 3.5 Low · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-693
- [enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain](https://agentprime.io/advisories/GHSA-7qm7-455j-5p63.md)
  `GHSA-7qm7-455j-5p63`, `CVE-2026-22686` · npm `enclave-vm`: affected `<2.7.0`, fixed in `2.7.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2026 · Tags: Code injection, CWE-693
- [Windows Remote Assistance Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-20824.md)
  `CVE-2026-20824` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-693
- [Sandbox escape in the Messaging System component](https://agentprime.io/advisories/CVE-2026-0881.md)
  `CVE-2026-0881` · CVE record: Mozilla Firefox and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2026 · Tags: Broken access control, CWE-693
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-0877.md)
  `CVE-2026-0877` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-693
- [pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"](https://agentprime.io/advisories/GHSA-379q-355j-w6rj.md)
  `GHSA-379q-355j-w6rj`, `CVE-2025-69264` · npm `pnpm`: affected `>=10.0.0, <10.26.0`, fixed in `10.26.0` · CVSS 8.8 High · Not analysed yet · Published 7 Jan 2026 · Tags: CWE-693
- [EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism](https://agentprime.io/advisories/CVE-2025-15422.md)
  `CVE-2025-15422` · CVE record: EmpireSoft EmpireCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jan 2026 · Tags: CWE-693
- [Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller](https://agentprime.io/advisories/GHSA-x843-g5mx-g377.md)
  `GHSA-x843-g5mx-g377`, `CVE-2025-71373` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 7.6 High · Not analysed yet · Published 29 Dec 2025 · Tags: Code injection, Insecure deserialization, CWE-693
- [Picklescan Bypasses Unsafe Globals Check using pty.spawn](https://agentprime.io/advisories/GHSA-hgrh-qx5j-jfwx.md)
  `GHSA-hgrh-qx5j-jfwx`, `CVE-2025-71322`, `PYSEC-2026-1790` · PyPI `picklescan`: affected `<0.0.33`, fixed in `0.0.33` · CVSS 8.7 High · Not analysed yet · Published 29 Dec 2025 · Tags: CWE-693
- [n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node](https://agentprime.io/advisories/GHSA-62r4-hw23-cc8v.md)
  `GHSA-62r4-hw23-cc8v`, `CVE-2025-68668` · npm `n8n`: affected `>=1.0.0, <2.0.0`, fixed in `2.0.0` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 26 Dec 2025 · Tags: CWE-693
- [Protection mechanism failure in Apple macOS](https://agentprime.io/advisories/CVE-2025-46281.md)
  `CVE-2025-46281` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693
- [Protection mechanism failure in Apple macOS](https://agentprime.io/advisories/CVE-2025-46291.md)
  `CVE-2025-46291` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693
- [HCL BigFix Remote Control is vulnerable to an insecure CSP configuration](https://agentprime.io/advisories/CVE-2025-59849.md)
  `CVE-2025-59849` · CVE record: HCL Software BigFix Remote Control · CVSS 4.7 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693, CWE-1021
- [Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store](https://agentprime.io/advisories/CVE-2025-13326.md)
  `CVE-2025-13326` · CVE record: Mattermost Mattermost · CVSS 3.9 Low · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693
- [Privilege boundary violation in Radiometer Products](https://agentprime.io/advisories/CVE-2025-14095.md)
  `CVE-2025-14095` · CVE record: Radiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS Analyzers and 3 more · CVSS 6.8 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Broken access control, CWE-693
- [ASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism Failure](https://agentprime.io/advisories/CVE-2025-14304.md)
  `CVE-2025-14304` · CVE record: ASRock Intel 500 chipset motherboard and 4 more · CVSS 7.0 High · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693
- [MSI｜Motherboard - Protection Mechanism Failure](https://agentprime.io/advisories/CVE-2025-14303.md)
  `CVE-2025-14303` · CVE record: MSI Intel 600 chipset motherboard and 1 more · CVSS 7.0 High · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693
- [GIGABYTE｜Motherboard - Protection Mechanism Failure](https://agentprime.io/advisories/CVE-2025-14302.md)
  `CVE-2025-14302` · CVE record: GIGABYTE intel 600 chipset Motherboard and 4 more · CVSS 7.0 High · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-693
- [When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file p…](https://agentprime.io/advisories/CVE-2025-65319.md)
  `CVE-2025-65319` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-693
- [When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file pr…](https://agentprime.io/advisories/CVE-2025-65318.md)
  `CVE-2025-65318` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-36938.md)
  `CVE-2025-36938` · CVE record: Google Android · CVSS 6.8 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-693

Newest: <https://agentprime.io/advisories/tag/cwe-693.md>
Older: <https://agentprime.io/advisories/tag/cwe-693.md?cursor=WyIyMDI1LTEyLTExVDE5OjM1OjUxLjQzMjAwMFoiLCJDVkUtMjAyNS0zNjkzOCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-693&cursor=WyIyMDI2LTAzLTEyVDE1OjA5OjM5LjIwOTAwMFoiLCJDVkUtMjAyNi0yMTY3MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-693/?cursor=WyIyMDI2LTAzLTEyVDE1OjA5OjM5LjIwOTAwMFoiLCJDVkUtMjAyNi0yMTY3MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.