Advisories · Weakness
CWE-693.
Every Advisory and CVE whose sources give the weakness CWE-693, newest first.
- CVSS 8.1 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 8.3 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 3.1 Low
Protection mechanism failure in Google Chrome
- Google Chrome
- Broken access control
- CWE-693
- CVSS 4.2 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 3.1 Low
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.4 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 7.8 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 3.1 Low
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
ciguard: Web UI is missing HTTP defence-in-depth headers
- CWE-693
>=0.1.0, <0.8.2 · fixed in 0.8.2
GHSA-7ww3-xvf5-cxwm - CVSS 8.2 High
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
- Server-side request forgery (SSRF)
- CWE-20
<2.1.7 · fixed in 2.1.7
GHSA-v228-72c7-fx8j · CVE-2026-42260 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has a WASM Sandbox Escape
- Code injection
- CWE-653
<3.10.5 · fixed in 3.10.5
GHSA-ffh4-j6h5-pg66 · CVE-2026-26956 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has a Sandbox Escape Issue via SuppressedError
- Code injection
- CWE-653
<3.11.0 · fixed in 3.11.0
GHSA-55hx-c926-fr95 · CVE-2026-26332 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has Sandbox Breakout Through Inspect Function
- Code injection
- CWE-653
<3.11.0 · fixed in 3.11.0
GHSA-v37h-5mfm-c47c · CVE-2026-24781 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Has Sandbox Breakout Through Promise Species
- Code injection
- CWE-693
<3.10.5 · fixed in 3.10.5
GHSA-qvjj-29qf-hp7p · CVE-2026-24120 - CVSS 9.8 CriticalCritical · CVSS 9+
VM2 Sandbox Breakout Through __lookupGetter__
- Code injection
- CWE-693
<3.11.0 · fixed in 3.11.0
GHSA-grj5-jjm8-h35p · CVE-2026-24118 - CVSS 8.1 High
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
- Insecure deserialization
- CWE-693
<4.0.3.1 || >=4.0.4, <4.0.4.1 || >=5.0.0, <6.0.1.1 || >=6.0.2, <6.0.4 · fixed in 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4
GHSA-q339-8rmv-2mhv · CVE-2026-41316 - CVSS 8.8 High
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
- Command injection
- Code injection
<2.0.3 · fixed in 2.0.3
GHSA-8h25-q488-4hxw · CVE-2026-41900 - CVSS 5.1 Medium
Beghelli Sicuro24 SicuroWeb Missing Content Security Policy
- Beghelli SicuroWeb (Sicuro24)
- CWE-693
- CVSS 7.5 High
Spring Security Doesn't Correctly Include Servlet Path in Path Matching of HttpSecurity#securityMatchers
- CWE-693
>=7.0.0, <7.0.5 · fixed in 7.0.5
GHSA-4wrg-8wpc-h923 · CVE-2026-22753 - CVSS 5.3 Medium
Protection mechanism failure in Oracle Corporation Oracle Java SE and others
- Oracle Corporation Oracle Java SE
- Oracle Corporation Oracle GraalVM for JDK
- CWE-693
- CVSS 8.2 High
ClearanceKit: opfilter system extension can be suspended or signalled by a root process, disabling file-access policy enforcement
- craigjbass clearancekit
- CWE-693
- CVSS 5.4 Medium
Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 6.5 Medium
Mitigation bypass in the File Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode w…
- CWE-693
- CVSS 7.1 High
OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads
- Broken access control
- CWE-693
<2026.4.9 · fixed in 2026.4.9
GHSA-qmwg-qprg-3j38 · CVE-2026-43577 - CVSS 4.9 Medium
October Rain has a Twig Sandbox Bypass via Collection Methods
- Broken access control
- CWE-693
<3.7.13 || >=4.0.0, <4.1.5 · fixed in 3.7.13, 4.1.5
GHSA-m5qg-jc75-4jp6 · CVE-2026-22692 - CVSS 5.5 Medium
ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.
- Memory corruption
- CWE-693
<14.12.0 · fixed in 14.12.0
GHSA-r83h-crwp-3vm7 · CVE-2026-40311 - CVSS 8.8 High
Windows Shell Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
- CVSS 4.3 MediumCritical · KEVKEV
Windows Shell Spoofing Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
- CVSS 3.1 Low
MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing
- 1Panel-dev MaxKB
- Other injection
- Authentication bypass
- CVSS 6.3 Medium
MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect
- 1Panel-dev MaxKB
- Code injection
- CWE-693
- CVSS 6.3 Medium
MaxKB: Sandbox escape via LD_PRELOAD bypass
- 1Panel-dev MaxKB
- Command injection
- CWE-693
- CVSS 8.6 High
PraisonAI Vulnerable to Code Injection and Protection Mechanism Failure
- Code injection
- CWE-693
<4.5.128 · fixed in 4.5.128
GHSA-3c4r-6p77-xwr7 · CVE-2026-40158 - CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.1 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 7.9 High
Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr
- Broken access control
- CWE-693
<=2.6 · no fixed version yet
GHSA-69v7-xpr6-6gjm · CVE-2026-34444 - CVSS 8.7 High
Directus: Missing Cross-Origin Opener Policy
- CWE-346
- CWE-693
<11.17.0 · fixed in 11.17.0
GHSA-8m32-p958-jg99 · CVE-2026-35408 - CVSS 10.0 CriticalCritical · CVSS 9+
SandboxJS: Sandbox integrity escape
- Broken access control
- CWE-693
<0.8.36 · fixed in 0.8.36
GHSA-2gg9-6p7w-6cpj · CVE-2026-34208 - CVSS 8.3 High
cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution
- fccview cronmaster
- Authentication bypass
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key
- MOCK Business::OnlinePayment::StoredTransaction
- Weak cryptography or TLS
- CWE-693
- CVSS 8.8 High
vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out
- CWE-501
- CWE-693
>=0.10.1, <0.18.0 · fixed in 0.18.0
GHSA-7972-pg2x-xr59 · CVE-2026-27893 - CVSS 7.7 High
OpenClaw has Inconsistent Host Exec Environment Override Sanitization
- CWE-15
- CWE-693
<2026.3.22 · fixed in 2026.3.22
GHSA-39pp-xp36-q6mg · CVE-2026-35650 - CVSS 10.0 CriticalCritical · CVSS 9+
OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe
- oneuptime
- Command injection
- CWE-184
- CVSS 4.0, no score published
@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers
- Cross-site scripting (XSS)
- CWE-693
<0.70.4 · fixed in 0.70.4
GHSA-3mjm-x6gw-2x42 - CVSS 7.5 High
Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- CWE-693
- CVSS 9.3 CriticalCritical · CVSS 9+
Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse
- CWE-693
<7.0.0 · fixed in 7.0.0
GHSA-5wr9-m6jw-xx44 · CVE-2026-74790 - CVSS 6.1 Medium
A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution
- Code injection
- Broken access control
>=0.8.3 · no fixed version yet
GHSA-w5pc-m664-r62v · CVE-2026-33622 - CVSS 4.6 Medium
Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)
- step-security harden-runner
- Broken access control
- CWE-693
- CVSS 4.6 Medium
Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)
- step-security harden-runner
- Broken access control
- CWE-693
- CVSS 8.8 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 8.6 High
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
- CWE-345
- CWE-494
<1.21.0rc1 · fixed in 1.21.0rc1
GHSA-hqmj-h5c6-369m · CVE-2026-28500 - CVSS 4.7 Medium
HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environment
- HCL AION
- CWE-693
- CVSS 8.8 High
Protection mechanism failure in Veeam Backup and Replication
- Veeam Backup and Replication
- CWE-693
- CVSS 10.0 CriticalCritical · CVSS 9+
Protection mechanism failure in Veeam Backup and Replication
- Veeam Backup and Replication
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
Protection mechanism failure in Veeam Software Appliance
- Veeam Software Appliance
- CWE-693