Advisories · Weakness
CWE-693.
Every Advisory and CVE whose sources give the weakness CWE-693, newest first.
- CVSS 4.3 Medium
Protection mechanism failure in Jenkins Project Jenkins Violation Comments to GitLab Plugin
- Jenkins Project Jenkins Violation Comments to GitLab Plugin
- CWE-693
- CVSS 7.2 High
Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
- CWE-693
- CWE-1021
<39.8.10 || >=40.0.0-alpha.1, <41.10.3 || >=42.0.0-alpha.1, <42.0.1 · fixed in 39.8.10, 41.10.3, 42.0.1
GHSA-9f4c-93c8-jc8g · CVE-2026-70608 - CVSS 7.5 High
Electron: Context isolation bypass via Function.prototype.bind hijack
- CWE-693
<39.8.9 || >=40.0.0-alpha.1, <40.9.2 || >=41.0.0-alpha.1, <41.2.2 || >=42.0.0-alpha.1, <42.0.0-beta.5 · fixed in 39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5
GHSA-h7rp-cf8h-j98x · CVE-2026-70601 - CVSS 5.3 Medium
Ghost Content API filter bypass reveals private fields
- Information disclosure
- CWE-693
>=5.46.1, <6.21.2 · fixed in 6.21.2
GHSA-jx35-x7fj-vgpr · CVE-2026-53949 - CVSS 8.6 High
Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
- Hard-coded credentials
- Information disclosure
<2.26.7 · fixed in 2.26.7
GHSA-hr7p-wg7r-hg9m · CVE-2026-67427 - CVSS 9.6 CriticalCritical · CVSS 9+
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.3 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.5 Medium
Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.8 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 8.8 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 9.6 CriticalCritical · CVSS 9+
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 9.6 CriticalCritical · CVSS 9+
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 5.4 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 5.8 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 9.6 CriticalCritical · CVSS 9+
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 9.6 CriticalCritical · CVSS 9+
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 8.8 High
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 9.6 CriticalCritical · CVSS 9+
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 9.6 CriticalCritical · CVSS 9+
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.2 Medium
Protection mechanism failure in Google Chrome
- Google Chrome
- CWE-693
- CVSS 4.0, no score published
netfoil: Incorrect block responses could lead to localhost traffic
- CWE-693
<0.4.0 · fixed in 0.4.0
GHSA-xvg2-cgv6-6h7v - CVSS 5.5 Medium
Authentication bypass by spoofing in Apple macOS
- Apple macOS
- Authentication bypass
- CWE-693
- CVSS 5.5 Medium
Authentication bypass by spoofing in Apple macOS
- Apple macOS
- Authentication bypass
- CWE-693
- CVSS 5.5 Medium
Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-693
- CVSS 7.8 High
Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-693
- CVSS 6.5 Medium
Protection mechanism failure in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- CWE-693
- CVSS 6.5 Medium
Apache Wicket: leaked and missing CSP headers
- Apache Software Foundation Apache Wicket
- Weak cryptography or TLS
- CWE-693
- CVSS 4.0, no score published
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
- CWE-693
>=0.3.0, <0.6.1 · fixed in 0.6.1
GHSA-qqc3-94qv-7fw3 - CVSS 4.3 Medium
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
- CWE-693
<0.10.0 · fixed in 0.10.0
GHSA-qg3f-8x3j-ggf2 · CVE-2026-59223 - CVSS 7.1 High
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
- CWE-693
<2.27.4 || >=2.28.0, <2.28.1 · fixed in 2.27.4, 2.28.1
GHSA-h44j-f5r5-ph73 · CVE-2026-59207 - CVSS 8.8 High
An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.
- CWE-693
- CVSS 8.8 High
An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism
- CWE-693
- CVSS 5.4 Medium
BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability.
- CWE-693
- CVSS 8.8 High
An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.
- CWE-693
- CVSS 8.8 High
An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
- CWE-693
- CVSS 8.8 High
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
- CWE-693
- CVSS 3.1 Low
Protection mechanism failure in Oracle Corporation Oracle Java SE
- Oracle Corporation Oracle Java SE
- CWE-693
- CVSS 3.1 Low
Protection mechanism failure in Oracle Corporation Oracle Java SE
- Oracle Corporation Oracle Java SE
- CWE-693
- CVSS 5.1 Medium
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
- Cross-site scripting (XSS)
- CWE-184
<3.4.12 · fixed in 3.4.12
GHSA-c2j3-45gr-mqc4 · CVE-2026-66010 - CVSS 3.1 Low
HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing
- HCLSoftware IntelliOps Event Management
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Mitigation bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Sandbox escape in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Mitigation bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Mitigation bypass in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
Sandbox escape due to use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-693
- CVSS 6.1 Medium
Protection mechanism failure in Dell ThinOS 10
- Dell ThinOS 10
- CWE-693
- CVSS 7.8 High
Visual Studio Remote Code Execution Vulnerability
- Microsoft Visual Studio 2022 version 17.12
- Microsoft Visual Studio 2022 version 17.14
- CWE-693
- CVSS 6.1 Medium
Windows BitLocker Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693