CWE-427
CVEs classified under CWE-427, newest first.
134 CVEsRSS
CVE-2026-104349High· 7.3Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execu…
CVE-2026-118131NoneCVE-2026-118131
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories u…
CVE-2026-91093High· 8.5HP One Agent Software – Security Update
A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate…
CVE-2026-92202High· 7.80dayLuxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is r…
CVE-2026-102438High· 8.5An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.…
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.…
CVE-2026-71170High· 7.8Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability
Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and …
CVE-2026-110936Medium· 6.7CISA KEVPoCA vulnerability has been identified in Siemens Software Center (All versions)
A vulnerability has been identified in Siemens Software Center (All versions). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a spe…
CVE-2026-62847Medium· 8.2Metalama allows local code execution through DLL planting in shared temporary directories
Metalama allows local code execution through DLL planting in shared temporary directories
CVE-2026-108390Critical· 9.9PoCHestia Control Panel is a lightweight and powerful control panel for the modern web
Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a us…
CVE-2026-103845High· 8.6Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execu…
CVE-2026-96238Medium· 6.5Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96237High· 7.5Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
CVE-2026-69923High· 7.8Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.
Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.
CVE-2026-108693High· 7.0PoCImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswi…
CVE-2026-107814High· 8.4MariaDB server is a community developed fork of MySQL server
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as …
CVE-2026-61446High· 8.4PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
CVE-2026-107615High· 7.8An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges
An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screen…
CVE-2026-106186High· 8.6⚖ disputedUncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security sever…
CVE-2026-104809High· 8.4DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without…
CVE-2026-47570High· 7.8NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled search path
NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled search path. A successful exploit of this vulnerability might lead to code execut…
CVE-2026-89325High· 7.8An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Asse…
An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Asse…
CVE-2026-6935High· 7.8IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution
IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search pat…
CVE-2026-91803High· 8.8A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations
A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit t…
CVE-2026-94574High· 7.8A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execut…
A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execut…
CVE-2026-83598High· 7.8Netdata is an open source observability tool
Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell…
CVE-2026-25264High· 8.8Privilege escalation due to weak configuration during package extraction process.
Privilege escalation due to weak configuration during package extraction process.
CVE-2026-54916High· 8.8NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests dire…
CVE-2026-56795High· 8.2Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability
Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
CVE-2026-92838High· 7.8A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application
A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in …
CVE-2026-92180High· 7.80daypdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PD…