# CWE-693.

Every Advisory and CVE whose sources give the weakness CWE-693, newest first.

## Records, newest first (an older page)

- [DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)](https://agentprime.io/advisories/GHSA-mrv2-3pqr-j5jr.md)
  `GHSA-mrv2-3pqr-j5jr`, `CVE-2026-116803` · npm `dompurify`: affected `<3.4.17`, fixed in `3.4.17` · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-693
- [Sentry-Javascript: Middleware Bypass when using Tunnel route](https://agentprime.io/advisories/GHSA-mchm-gjx6-7h55.md)
  `GHSA-mchm-gjx6-7h55`, `CVE-2026-114139` · npm `@sentry/nextjs`: affected `>=9.36.0, <9.47.2 || >=10.0.0-alpha.0, <10.75.2 || >=11.0.0-alpha.0, <11.0.0-rc.1`, fixed in `9.47.2`, `10.75.2`, `11.0.0-rc.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-693
- [Protection Mechanism Failure in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76528.md)
  `CVE-2026-76528` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-693
- [Security Hardening in Splunk Enterprise - October 2026](https://agentprime.io/advisories/CVE-2026-76301.md)
  `CVE-2026-76301` · CVE record: Splunk Splunk Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-693
- [OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies](https://agentprime.io/advisories/GHSA-crwc-vw2r-qr6m.md)
  `GHSA-crwc-vw2r-qr6m`, `CVE-2026-113730` · Maven `ognl:ognl`: affected `<3.4.13`, fixed in `3.4.13` · CVSS 5.6 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-693
- [Protection mechanism failure in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-91402.md)
  `CVE-2026-91402` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 3.1 Low · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-693
- [Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts](https://agentprime.io/advisories/CVE-2026-113609.md)
  `CVE-2026-113609` · CVE record: Bandisoft Bandizip · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-693
- [Protection mechanism failure in Apple Xcode](https://agentprime.io/advisories/CVE-2026-86948.md)
  `CVE-2026-86948` · CVE record: Apple Xcode · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, CWE-693
- [Dolibarr CSP document.php protection mechanism](https://agentprime.io/advisories/CVE-2026-112361.md)
  `CVE-2026-112361` · CVE record: Dolibarr · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-693
- [radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism](https://agentprime.io/advisories/CVE-2026-112077.md)
  `CVE-2026-112077` · CVE record: radareorg radare2 · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-693
- [dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open](https://agentprime.io/advisories/CVE-2026-77474.md)
  `CVE-2026-77474` · CVE record: Dicklesworthstone destructive_command_guard · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service, CWE-693
- [Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation](https://agentprime.io/advisories/GHSA-2cvf-wqm6-wr9g.md)
  `GHSA-2cvf-wqm6-wr9g`, `CVE-2026-94603`, `GO-2026-6770` · Go `github.com/containers/podman/v4` and 2 more: affected `>=4.4.0, <5.8.8`, fixed in `5.8.8` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-693
- [Nginx UI: MCP \`nginx_config_add\` Bypasses Directive Validation — Authenticated RCE](https://agentprime.io/advisories/GHSA-9jww-cxg5-rj9m.md)
  `GHSA-9jww-cxg5-rj9m`, `CVE-2026-84318`, `GO-2026-6781` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250506154222-1330888280a2, <1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-693
- [Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)](https://agentprime.io/advisories/GHSA-76pm-mq2q-9gcr.md)
  `GHSA-76pm-mq2q-9gcr`, `CVE-2026-84317`, `GO-2026-6779` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-20, CWE-693
- [Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context](https://agentprime.io/advisories/GHSA-5r62-gj48-897x.md)
  `GHSA-5r62-gj48-897x`, `CVE-2026-84319`, `GO-2026-6774` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 8.3 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-693
- [Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation](https://agentprime.io/advisories/CVE-2026-104024.md)
  `CVE-2026-104024` · CVE record: PeaZip PeaZip · CVSS 4.6 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-184, CWE-693
- [Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name](https://agentprime.io/advisories/CVE-2026-104025.md)
  `CVE-2026-104025` · CVE record: PeaZip PeaZip · CVSS 8.4 High · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, CWE-693
- [Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request](https://agentprime.io/advisories/CVE-2026-110866.md)
  `CVE-2026-110866` · CVE record: renovatebot renovate and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-693
- [OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism](https://agentprime.io/advisories/CVE-2026-110689.md)
  `CVE-2026-110689` · CVE record: OpenClaw ClawScan · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-693
- [Gitea required Actions check bypass through skipped workflows](https://agentprime.io/advisories/CVE-2026-66874.md)
  `CVE-2026-66874` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control, CWE-345, CWE-693, CWE-807
- [Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions](https://agentprime.io/advisories/CVE-2026-88838.md)
  `CVE-2026-88838` · CVE record: Red Hat Red Hat Hardened Images · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [heym Python Tool Sandbox Escape](https://agentprime.io/advisories/CVE-2026-55376.md)
  `CVE-2026-55376` · CVE record: heymrun heym · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Command injection, Code injection, CWE-693
- [Mitigation bypass in the File Handling component](https://agentprime.io/advisories/CVE-2026-109783.md)
  `CVE-2026-109783` · CVE record: Mozilla Firefox and 1 more · CVSS 8.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the File Handling component](https://agentprime.io/advisories/CVE-2026-109782.md)
  `CVE-2026-109782` · CVE record: Mozilla Firefox and 1 more · CVSS 8.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-109780.md)
  `CVE-2026-109780` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-109766.md)
  `CVE-2026-109766` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-109760.md)
  `CVE-2026-109760` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Sandbox escape in the DOM: Content Processes component](https://agentprime.io/advisories/CVE-2026-109755.md)
  `CVE-2026-109755` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-109746.md)
  `CVE-2026-109746` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-109737.md)
  `CVE-2026-109737` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-109734.md)
  `CVE-2026-109734` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693
- [Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set](https://agentprime.io/advisories/CVE-2026-102539.md)
  `CVE-2026-102539` · CVE record: super-productivity super-productivity · CVSS 5.7 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure, CWE-693
- [Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying](https://agentprime.io/advisories/CVE-2026-109364.md)
  `CVE-2026-109364` · CVE record: ZcashFoundation zebra · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-693
- [Hex release-age cooldown is lifted package-wide when the locked release is retired](https://agentprime.io/advisories/CVE-2026-105668.md)
  `CVE-2026-105668` · CVE record: hexpm hex · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-693
- [PraisonAI: Shell command allowlist bypass via find -exec built-in action](https://agentprime.io/advisories/GHSA-cv3g-hj65-pcfh.md)
  `GHSA-cv3g-hj65-pcfh`, `CVE-2026-61434`, `PYSEC-2026-4254` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, CWE-693
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-16916.md)
  `CVE-2026-16916` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693
- [PraisonAI: Prompt-injection defense blocks only when 3+ detector families fire simultaneously; realistic single-vector injections pass through unblocked](https://agentprime.io/advisories/GHSA-4r3p-w3mc-5v34.md)
  `GHSA-4r3p-w3mc-5v34`, `CVE-2026-60086`, `PYSEC-2026-4248` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693
- [Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass](https://agentprime.io/advisories/GHSA-pc5q-qfxp-ggqv.md)
  `GHSA-pc5q-qfxp-ggqv`, `CVE-2026-104774`, `GO-2026-6696` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-172, CWE-193, CWE-693
- [FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()](https://agentprime.io/advisories/CVE-2026-107697.md)
  `CVE-2026-107697` · CVE record: FFmpeg FFmpeg · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693
- [AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS](https://agentprime.io/advisories/GHSA-p2jm-6hj6-9rjg.md)
  `GHSA-p2jm-6hj6-9rjg`, `CVE-2026-107226` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.14 || >=2.1.0, <=2.16.1`, fixed in `3.0.14` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-693
- [PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow](https://agentprime.io/advisories/GHSA-4gfv-wg42-7jw5.md)
  `GHSA-4gfv-wg42-7jw5`, `CVE-2026-61437`, `PYSEC-2026-4267` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693, CWE-829
- [Protection Mechanism Failure in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76283.md)
  `CVE-2026-76283` · CVE record: Splunk Splunk Enterprise · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-693
- [PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats](https://agentprime.io/advisories/GHSA-fj8f-m44g-c479.md)
  `GHSA-fj8f-m44g-c479`, `CVE-2026-61439`, `PYSEC-2026-4255` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-116, CWE-693, CWE-1188, CWE-1287
- [Hydra: Mutable instantiate policy sets allow target blocklist bypass](https://agentprime.io/advisories/GHSA-mwj6-rfh8-7qf4.md)
  `GHSA-mwj6-rfh8-7qf4`, `CVE-2026-106439`, `PYSEC-2026-4222` · PyPI `hydra-core`: affected `>=1.3.4, <1.3.7 || >=1.4.0.dev4, <1.4.0.dev10`, fixed in `1.3.7`, `1.4.0.dev10` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, CWE-693
- [vm2 contains a sandbox escape vulnerability](https://agentprime.io/advisories/GHSA-pq68-rvw4-xp4r.md)
  `GHSA-pq68-rvw4-xp4r`, `CVE-2026-93605` · npm `vm2`: affected `<3.12.1`, fixed in `3.12.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-693, CWE-913
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97673.md)
  `CVE-2026-97673` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-693
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97678.md)
  `CVE-2026-97678` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-693
- [Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding](https://agentprime.io/advisories/GHSA-6r3q-mjv7-xr8m.md)
  `GHSA-6r3q-mjv7-xr8m`, `CVE-2026-41510`, `GO-2026-6668` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.1`, fixed in `3.8.1` · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service, CWE-693
- [Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling](https://agentprime.io/advisories/GHSA-r3rm-qphw-hh76.md)
  `GHSA-r3rm-qphw-hh76`, `CVE-2026-41508`, `GO-2026-6670` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.4.0, <3.8.0`, fixed in `3.8.0` · CVSS 5.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-20, CWE-693, CWE-755
- [Protection mechanism failure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106408.md)
  `CVE-2026-106408` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-693
- [Mitigation bypass in the File Handling component](https://agentprime.io/advisories/CVE-2026-106016.md)
  `CVE-2026-106016` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-693
- [vm2: \`allowAsync: false\` can be bypassed through Promise thenable assimilation in VM and NodeVM](https://agentprime.io/advisories/GHSA-f8gf-w286-fmq2.md)
  `GHSA-f8gf-w286-fmq2`, `CVE-2026-92959` · npm `vm2`: affected `<3.11.8`, fixed in `3.11.8` · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-693
- [vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit](https://agentprime.io/advisories/GHSA-x965-fc75-jpqh.md)
  `GHSA-x965-fc75-jpqh`, `CVE-2026-92934` · npm `vm2`: affected `<3.11.8`, fixed in `3.11.8` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-693
- [vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack](https://agentprime.io/advisories/GHSA-r273-hxvj-fxhp.md)
  `GHSA-r273-hxvj-fxhp`, `CVE-2026-92933` · npm `vm2`: affected `<3.11.8`, fixed in `3.11.8` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, CWE-693
- [vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass](https://agentprime.io/advisories/GHSA-wjwh-qqvp-g4p4.md)
  `GHSA-wjwh-qqvp-g4p4`, `CVE-2026-92956` · npm `vm2`: affected `>=3.10.1, <3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-693, CWE-913
- [Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docli...](https://agentprime.io/advisories/GHSA-h42j-9hcc-3cwc.md)
  `GHSA-h42j-9hcc-3cwc`, `CVE-2026-105746`, `PYSEC-2026-4193` · PyPI `docling`: affected `>=2.83.0, <2.131.0`, fixed in `2.131.0` · CVSS 2.2 Low · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, CWE-693
- [ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE](https://agentprime.io/advisories/CVE-2026-105083.md)
  `CVE-2026-105083` · CVE record: ImageMagick ImageMagick · CVSS 1.8 Low · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-693
- [vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape](https://agentprime.io/advisories/GHSA-qhwx-74w5-xhxq.md)
  `GHSA-qhwx-74w5-xhxq`, `CVE-2026-92948` · npm `vm2`: affected `>=3.9.6, <3.11.7`, fixed in `3.11.7` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-693
- [vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor](https://agentprime.io/advisories/GHSA-633r-hq9m-c4ff.md)
  `GHSA-633r-hq9m-c4ff`, `CVE-2026-92949` · npm `vm2`: affected `>=3.9.6, <3.11.7`, fixed in `3.11.7` · CVSS 6.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-471, CWE-693
- [vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection](https://agentprime.io/advisories/GHSA-647f-g98j-qq25.md)
  `GHSA-647f-g98j-qq25`, `CVE-2026-92937` · npm `vm2`: affected `>=3.11.6, <3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection, CWE-693

Newest: <https://agentprime.io/advisories/tag/cwe-693.md>
Older: <https://agentprime.io/advisories/tag/cwe-693.md?cursor=WyIyMDI2LTEwLTAxVDE1OjMyOjEwLjAwMDAwMFoiLCJHSFNBLTY0N2YtZzk4ai1xcTI1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-693&cursor=WyIyMDI2LTEwLTIzVDEwOjQ0OjExLjk1MDAwMFoiLCJDVkUtMjAyNi0xMTE5NjUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-693/?cursor=WyIyMDI2LTEwLTIzVDEwOjQ0OjExLjk1MDAwMFoiLCJDVkUtMjAyNi0xMTE5NjUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.