Advisories · Weakness
CWE-693.
Every Advisory and CVE whose sources give the weakness CWE-693, newest first.
- CVSS 4.0, no score published
kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy
- CWE-693
<2.0.5 · fixed in 2.0.5
GHSA-x442-m7cc-hr92 - CVSS 5.3 Medium
@whyour/qinglong: manipulation of the argument command leads to protection mechanism failure
- CWE-693
<2.20.2 · fixed in 2.20.2
GHSA-xj37-qjg2-xwv2 · CVE-2026-3965 - CVSS 8.4 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 6.9 Medium
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
- CWE-693
<8.6.12 || >=9.0.0-alpha.1, <9.5.1-alpha.1 · fixed in 8.6.12, 9.5.1-alpha.1
GHSA-q342-9w2p-57fp · CVE-2026-30938 - CVSS 5.8 Medium
OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions
- Broken access control
- CWE-693
<2026.3.7 · fixed in 2026.3.7
GHSA-9q36-67vc-rrwg · CVE-2026-27646 - CVSS 6.5 Medium
Cloudfoundry UAA has logic error in the token revocation endpoint implementation
- CWE-640
- CWE-693
>=77.30.0, <78.8.0 · fixed in 78.8.0
GHSA-6wcw-r64p-qrrw · CVE-2026-22723 - CVSS 4.0, no score published
Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain unhooked
- CWE-693
<0.1.9 · fixed in 0.1.9
GHSA-wccx-j62j-r448 - CVSS 4.0, no score published
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
- Command injection
- CWE-693
<2026.2.22 · fixed in 2026.2.22
GHSA-8mf7-vv8w-hjr2 - CVSS 9.3 CriticalCritical · CVSS 9+
PickleScan has multiple stdlib modules with direct RCE not in blocklist
- CWE-184
- CWE-693
<1.0.4 · fixed in 1.0.4
GHSA-g38g-8gr9-h9xp · CVE-2026-56315 - CVSS 4.8 Medium
OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container
- CWE-693
- CWE-1188
<2026.2.21 · fixed in 2026.2.21
GHSA-43x4-g22p-3hrq · CVE-2026-32046 - CVSS 8.8 High
An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to perform Administrative actions using servic…
- CWE-693
- CVSS 9.3 CriticalCritical · CVSS 9+
OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>
- Broken access control
- CWE-693
<2026.2.24 · fixed in 2026.2.24
GHSA-ww6v-v748-x7g9 · CVE-2026-32038 - CVSS 8.8 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 7.7 High
Protection mechanism failure in Google Android
- Google Android
- Broken access control
- CWE-693
- CVSS 6.2 Medium
Improper access control in Google Android
- Google Android
- Broken access control
- CWE-693
- CVSS 8.4 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CWE-703
- CVSS 8.4 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 7.7 High
Protection mechanism failure in Google Android
- Google Android
- Information disclosure
- CWE-693
- CVSS 8.4 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 8.4 High
Protection mechanism failure in Google Android
- Google Android
- CWE-693
- CVSS 5.3 Medium
Lack of HTTP Response Headers
- CGM CLININET
- CWE-693
- CVSS 6.3 Medium
n8n has a Guardrail Node Bypass
- CWE-20
- CWE-693
<2.10.0 · fixed in 2.10.0
GHSA-fvfv-ppw4-7h2w · CVE-2026-56349 - CVSS 7.5 High
Information disclosure, mitigation bypass in the Settings UI component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-693
- CVSS 10.0 CriticalCritical · CVSS 9+
Sandbox escape in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-693
- CVSS 10.0 CriticalCritical · CVSS 9+
Sandbox escape in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 7.5 High
Protection mechanism failure in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- CWE-693
- CWE-703
- CVSS 8.8 High
Protection mechanism failure in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- CWE-693
- CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV
Windows Shell Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
- CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV
MSHTML Framework Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
- CVSS 9.4 CriticalCritical · CVSS 9+
n8n has a Python sandbox escape
- CWE-693
<2.4.8 · fixed in 2.4.8
GHSA-8398-gmmx-564h · CVE-2026-25115 - CVSS 9.4 CriticalCritical · CVSS 9+
n8n Merge Node has Arbitrary File Write leading to RCE
- Unrestricted file upload
- CWE-693
<1.118.0 || >=2.0.0, <2.4.0 · fixed in 1.118.0, 2.4.0
GHSA-hv53-3329-vmrm · CVE-2026-25056 - CVSS 6.0 Medium
L2TP over IPSec Encryption Failure on ArcherAXE75
- TP-Link Systems Inc. AXE75
- CWE-693
- CVSS 6.8 Medium
Anti-Tamper Bypass in BeyondTrust Privilege Management for Windows
- BeyondTrust Privilege management for Windows
- CWE-693
- CVSS 6.5 Medium
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
- CWE-693
<=0.1.0 · no fixed version yet
GHSA-gpx9-96j6-pp87 - CVSS 2.9 Low
x86: incomplete IBPB for vCPU isolation
- Xen
- CWE-665
- CWE-693
- CVSS 8.1 HighCritical · KEV, CVSS 7+ and EPSSKEV
SolarWinds Web Help Desk Security Control Bypass Vulnerability
- SolarWinds Web Help Desk
- CWE-693
- CVSS 10.0 CriticalCritical · CVSS 9+
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
- Code injection
- CWE-693
<0.8.26 · fixed in 0.8.26
GHSA-wxhw-j4hc-fmq6 · CVE-2026-23830 - CVSS 6.5 Medium
Mitigation bypass in the Privacy: Anti-Tracking component
- Mozilla Firefox
- CWE-693
- CVSS 9.8 CriticalCritical · CVSS 9+
vm2 has a Sandbox Escape
- Code injection
- CWE-693
<3.10.2 · fixed in 3.10.2
GHSA-99p7-6v5w-7xg8 · CVE-2026-22709 - CVSS 3.5 Low
HCL AION is affected by a Missing Security Response Headers vulnerability.
- HCL Software AION
- CWE-693
- CVSS 10.0 CriticalCritical · CVSS 9+
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain
- Code injection
- CWE-693
<2.7.0 · fixed in 2.7.0
GHSA-7qm7-455j-5p63 · CVE-2026-22686 - CVSS 5.5 Medium
Windows Remote Assistance Security Feature Bypass Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-693
- CVSS 10.0 CriticalCritical · CVSS 9+
Sandbox escape in the Messaging System component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-693
- CVSS 8.1 High
Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
- CVSS 8.8 High
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
- CWE-693
>=10.0.0, <10.26.0 · fixed in 10.26.0
GHSA-379q-355j-w6rj · CVE-2025-69264 - CVSS 6.9 Medium
EmpireSoft EmpireCMS IP Address connect.php egetip protection mechanism
- EmpireSoft EmpireCMS
- CWE-693
- CVSS 7.6 High
Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
- Code injection
- Insecure deserialization
<0.0.33 · fixed in 0.0.33
GHSA-x843-g5mx-g377 · CVE-2025-71373 - CVSS 8.7 High
Picklescan Bypasses Unsafe Globals Check using pty.spawn
- CWE-693
<0.0.33 · fixed in 0.0.33
GHSA-hgrh-qx5j-jfwx · CVE-2025-71322 - CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
- CWE-693
>=1.0.0, <2.0.0 · fixed in 2.0.0
GHSA-62r4-hw23-cc8v · CVE-2025-68668 - CVSS 8.4 High
Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-693
- CVSS 5.5 Medium
Protection mechanism failure in Apple macOS
- Apple macOS
- CWE-693
- CVSS 4.7 Medium
HCL BigFix Remote Control is vulnerable to an insecure CSP configuration
- HCL Software BigFix Remote Control
- CWE-693
- CWE-1021
- CVSS 3.9 Low
Mattermost Desktop App fails to enable Hardened Runtime when packaged for Mac App Store
- Mattermost
- CWE-693
- CVSS 6.8 Medium
Privilege boundary violation in Radiometer Products
- Radiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS Analyzers
- Radiometer Medical Aps AQT90 FLEX Analyzers
- Broken access control
- CWE-693
- CVSS 7.0 High
ASRock, ASRockRack, ASRockInd｜Motherboard - Protection Mechanism Failure
- ASRock Intel 500 chipset motherboard
- ASRockRack Intel 500 chipset motherboard
- CWE-693
- CVSS 7.0 High
MSI｜Motherboard - Protection Mechanism Failure
- MSI Intel 600 chipset motherboard
- MSI Intel 700 chipset motherboard
- CWE-693
- CVSS 7.0 High
GIGABYTE｜Motherboard - Protection Mechanism Failure
- GIGABYTE intel 600 chipset Motherboard
- GIGABYTE intel 700 chipset Motherboard
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file p…
- CWE-693
- CVSS 9.1 CriticalCritical · CVSS 9+
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file pr…
- CWE-693
- CVSS 6.8 Medium
Protection mechanism failure in Google Android
- Google Android
- CWE-693