CWE-426
CVEs classified under CWE-426, newest first.
92 CVEsRSS
CVE-2026-105477High· 7.3A vulnerability in Veeam Agent for Linux allows for local privilege escalation
A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.
CVE-2026-113461Medium· 5.2mk-oracle: Local privilege escalation via insecure Oracle Home library loading
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent …
CVE-2026-0315Medium· 5.9A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with adminis…
CVE-2026-103847High· 8.6Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker wi…
CVE-2026-83509High· 7.0Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVE-2026-83506High· 7.8Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVE-2026-83505High· 7.0Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
CVE-2026-70142High· 7.8Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69882High· 7.8Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
CVE-2026-69733High· 7.8Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
CVE-2026-108398High· 8.8Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
CVE-2026-4869Medium· 5.4A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup…
CVE-2026-75782High· 7.8IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
CVE-2026-105331Medium· 5.2Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
CVE-2026-106505High· 7.7Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to…
CVE-2026-104809High· 8.4DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without…
CVE-2026-59265High· 8.8PoCA code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed …
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed …
CVE-2026-19547High· 7.0Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by defau…
CVE-2026-87723Medium· 5.4In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows th…
CVE-2026-100584Medium· 6.7OpenClaw is an npm-distributed agent runtime
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently exec…
CVE-2026-100310High· 7.0PoCGNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a dir…
CVE-2026-68492High· 8.7An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
CVE-2026-92587Medium· 5.0n8n is a workflow automation platform
n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git …
CVE-2026-0307Medium· 5.9GlobalProtect App: Local Privilege Escalation Vulnerabilities
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administr…
CVE-2026-81192High· 7.0`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS
`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute dete…
CVE-2026-80159Medium· 4.0Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation
Acrobat Reader is affected by an Untrusted Search Path vulnerability that could result in privilege escalation. An attacker with high privileges could leverage this vulnerability to gain elevated access. Exploit depends on conditions bey…
CVE-2026-78574High· 7.5The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, re…
CVE-2026-69785High· 7.8Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.
Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.
CVE-2026-69328High· 7.8PoCUntrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-84226High· 8.5OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps
OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps