CWE-693
CVEs classified under CWE-693, newest first.
410 CVEsRSS
CVE-2026-114614Low· 2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
CVE-2026-116145Low· 3.9ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input to ImageMagick can evade configure…
CVE-2026-115480Medium· 5.3baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissions without enforcing the form's auth_…
CVE-2026-111965Medium· 4.3Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the Wor…
CVE-2026-56838High· 7.8PraisonAI recipe.run_stream skips dangerous-tool policy enforcement
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run…
CVE-2026-57144High· 8.8PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native()…
GHSA-mrv2-3pqr-j5jrHighDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
CVE-2026-114139Critical· 9.1Sentry-Javascript: Middleware Bypass when using Tunnel route
Sentry-Javascript: Middleware Bypass when using Tunnel route
CVE-2026-76301NoneSecurity Hardening in Splunk Enterprise - October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discov…
CVE-2026-76528NoneProtection Mechanism Failure in Splunk SOAR
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discov…
CVE-2026-113730Medium· 5.6OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
CVE-2026-113609Low· 3.3Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloade…
CVE-2026-112361Medium· 6.3Dolibarr CSP document.php protection mechanism
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be execute…
CVE-2026-112077Medium· 5.6radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism
A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in…
CVE-2026-77474High· 7.1dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns…
CVE-2026-104024Medium· 4.6Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open a…
Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open a…
CVE-2026-104025High· 8.4Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with…
Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with…
CVE-2026-110866Medium· 4.7Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency …
CVE-2026-110689Medium· 5.3PoCA security flaw has been discovered in OpenClaw ClawScan up to 0.1.6
A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. Performing a manipulation results in protection m…
CVE-2026-66874Medium· 6.5For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a…
CVE-2026-94603Critical· 10.0Podman is a tool for managing OCI containers and pods
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied …
CVE-2026-88838Medium· 5.5A flaw was found in BusyBox's mount utility
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged wit…
CVE-2026-55376High· 8.8PoCHeym builds and runs agentic systems and business-process automations on self-hosted infrastructure
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based…
CVE-2026-102734Medium· 5.5asteval is a Python expression evaluator designed for restricted execution
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blo…
CVE-2026-109755Critical· 9.6Sandbox escape in the DOM: Content Processes component
Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
CVE-2026-101899Medium· 6.9PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an …
CVE-2026-102539Medium· 5.7PoCSuper Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, c…
CVE-2026-84319High· 8.3Nginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface al…
CVE-2026-84318High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The id…
CVE-2026-84317High· 8.8PoCNginx UI is a web user interface for the Nginx web server
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl module…