CWE-693 vulnerabilities

CVE-2026-81376 is a critical vulnerability in Microsoft Visual Studio Code versions 1.0.0 up to but not including 1.136.2. It involves an incomplete comparison with missing factors that allows an unauthorized attacker to bypass a security feature over a network. The vulnerability has a high impact on confidentiality, integrity, and availability. An official fix is available in version 1.136.2.

CVE-2026-77892 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds where the Windows Boot Manager fails to properly enforce protection mechanisms, allowing an unauthorized attacker with physical access to elevate privileges. The issue is classified under CWE-693 (Protection Mechanism Failure). A fix has been officially released by Microsoft for affected versions.

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges.

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges.

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths.

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than intended.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

CVE-2026-59277 is a low-severity vulnerability in Spring Security 7.1.0 involving the InetAddressMatchers utility. This utility provides builders to classify IP addresses as internal or external networks. The issue relates to a protection mechanism failure (CWE-693) in this classification functionality.

CVE-2026-79988 is a high-severity vulnerability in Craft CMS where the Twig sandbox mechanism is improperly configured, allowing dangerous Yii framework functionality. This misconfiguration enables authenticated remote code execution (RCE) similar to previously known issues. The affected versions include 4.0.0-RC1 and 5.0.0-RC1. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-61792 is a path traversal vulnerability in Weblate prior to version 2026.7. It allows a project administrator to read files outside their repository via the App store metadata download feature due to insufficient path restriction. This vulnerability is an incomplete fix of a previous issue (CVE-2026-34242) and permits disclosure of arbitrary files on the Weblate host. The issue is resolved in version 2026.7.

NVIDIA DGX Spark has a vulnerability in its UEFI firmware that allows a privileged local user to bypass administrator password protection. This issue is classified as a CWE-693 Protection Mechanism Failure. Exploiting this vulnerability could lead to unauthorized changes in the system's UEFI settings without needing the administrator password.

CVE-2026-52873 is a cross-site scripting (XSS) vulnerability in the Streambert Electron desktop app versions prior to 2.6.0. The vulnerability arises because the wyzie-open-redeem IPC handler removes the Content-Security-Policy header in a specific Electron session, allowing script injection from a third-party resource or navigated sites without CSP restrictions. Exploitation requires user interaction to open the Wyzie API key redemption window and attacker-controlled script content in a loaded page. This can lead to execution of malicious scripts that invoke application functionality and potentially access sensitive data. The issue is fixed in version 2.6.0.

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.

CVE-2026-47686 is a critical vulnerability in the vm2 sandbox for Node.js prior to version 3.11.6. The vulnerability arises because the handleException() function does not sanitize the Error.cause property, allowing sandboxed code to access powerful host objects like process via specially crafted errors. This can lead to arbitrary command execution on the host. The issue is fixed in vm2 version 3.11.6.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter.

CVE-2026-18428 is a high-severity vulnerability in AWS OpenSearch's SQL plugin. It involves a SQL query validation bypass in the Flint extension query handler, allowing a remote authenticated user with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query. This flaw affects OpenSearch versions from 2.13 up to and including 3.6. AWS manages remediation for this cloud service and has released a patch to address the issue.

A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.