CWE-427 · Uncontrolled Search Path Element

1209 CVEs classified under CWE-427 (Uncontrolled Search Path Element). Browse by severity and year.

Top CVEs for CWE-427
CVESeverityScorePublishedSummary
CVE-2026-16860Critical9.92026-08-12IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.
CVE-2026-40342Critical9.92026-04-17Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates…
CVE-2025-4981Critical9.92025-06-20Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extract…
CVE-2025-69599Critical9.82026-05-08RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. NOTE: this is disp…
CVE-2019-25268Critical9.82026-01-08NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files fr…
CVE-2023-53959Critical9.82025-12-19FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the appl…
CVE-2025-65741Critical9.82025-12-09Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library…
CVE-2024-23054Critical9.82024-02-05An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++stati…
CVE-2023-31543Critical9.82023-06-30A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository se…
CVE-2023-25143Critical9.82023-03-10An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state…
CVE-2022-34825Critical9.82022-11-08Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe f…
CVE-2022-24955Critical9.82022-02-11Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.
CVE-2021-28955Critical9.82021-03-22git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on…
CVE-2020-27955Critical9.82020-11-05Git LFS 2.12.0 allows Remote Code Execution.
CVE-2019-20856Critical9.82020-06-19An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
CVE-2019-20780Critical9.82020-04-17An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Certain security settings, related to whether packages are v…
CVE-2020-10515Critical9.82020-04-02STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006.
CVE-2019-9546Critical9.82019-03-01SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service.
CVE-2019-7653Critical9.82019-02-09The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code in…
CVE-2018-12805Critical9.82018-07-20Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation.
All CVEs classified under CWE-427 — newest first (page 1 of 13)
CVESeverityScorePublishedSummary
CVE-2026-56090High7.32026-08-17Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could po…
CVE-2026-02942026-08-13A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code…
CVE-2026-16860Critical9.92026-08-12IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.
CVE-2025-545122026-08-11A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulti…
CVE-2026-341752026-08-11Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation o…
CVE-2026-327882026-08-11Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring 3: User Applications may allow an esca…
CVE-2026-287002026-08-11Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged softwar…
CVE-2025-80872026-08-11A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, pote…
CVE-2025-485062026-08-11Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulti…
CVE-2025-00412026-08-11Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrar…
CVE-2026-131332026-08-10A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secu…
CVE-2026-9169High8.82026-08-07DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the app…
CVE-2026-66344Medium6.72026-08-05NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attack…
CVE-2026-18657High7.82026-08-04An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a mal…
CVE-2026-18656High7.82026-08-04An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a ma…
CVE-2026-18718High7.02026-08-03Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a…
CVE-2026-18605High7.02026-08-03A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mi…
CVE-2026-9593Medium6.72026-08-03A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted fi…
CVE-2026-48388High8.62026-07-28Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context…
CVE-2026-8164High7.32026-07-28Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijackin…
CVE-2026-16519High7.32026-07-24A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs)…
CVE-2026-21770Medium6.52026-07-17HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application wi…
CVE-2026-5674High8.82026-07-16A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeW…
CVE-2026-42936High7.82026-07-15The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arb…
CVE-2026-48272High7.82026-07-14Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the cur…
CVE-2026-0487High8.42026-07-14SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious co…
CVE-2026-48364High8.22026-07-13ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution…
CVE-2026-48363High8.22026-07-13ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution…
CVE-2026-15515High7.02026-07-13A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the…
CVE-2026-57239High8.22026-07-08The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate t…
CVE-2026-56437High7.82026-07-08Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer…
CVE-2026-38972High7.82026-07-02Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibr…
CVE-2026-54672High7.82026-06-30electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component…
CVE-2025-13162Medium4.42026-06-23Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800…
CVE-2026-54232High8.82026-06-22vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack t…
CVE-2026-49241High8.82026-06-22The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Serv…
CVE-2026-66452026-06-22An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, wh…
CVE-2026-119582026-06-18Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to t…
CVE-2026-120032026-06-16To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to loca…
CVE-2024-22451Medium6.72026-06-16Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vu…
CVE-2024-22447Medium6.72026-06-16Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnera…
CVE-2026-50642026-06-15Potential security vulnerabilities have been identified in the HP One Agent for certain HP PC products, which might allow for escalation of pri…
CVE-2026-50100High7.82026-06-15Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is…
CVE-2026-119672026-06-12MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading a malicious DLL located in the same directo…
CVE-2026-118792026-06-12MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a temporary directory t…
CVE-2026-53813High7.82026-06-11OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolutio…
CVE-2026-7870High8.82026-06-11IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled c…
CVE-2026-10847High7.82026-06-11A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitra…
CVE-2026-8637High7.82026-06-10A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to exec…
CVE-2026-47937High7.72026-06-09Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary…
CVE-2026-41567High7.22026-06-05Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a…
CVE-2026-50033High7.32026-06-03Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.932…
CVE-2026-44682High7.32026-06-03Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.932…
CVE-2026-44609High7.32026-06-03Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.932…
CVE-2026-36574High7.82026-06-03A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
CVE-2026-44358High8.22026-05-28Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh inv…
CVE-2026-47274Medium6.32026-05-27pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries thr…
CVE-2023-52945High7.82026-05-27Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbit…
CVE-2025-41670High7.82026-05-27A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related file…
CVE-2025-145752026-05-19An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a…
CVE-2026-32323High7.32026-05-19Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation durin…
CVE-2026-47092High7.82026-05-18Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnerability that allows local attackers to execute arbitrary commands by m…
CVE-2024-36333High7.82026-05-15A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execut…
CVE-2026-73732026-05-15Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the…
CVE-2025-626282026-05-14Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arb…
CVE-2024-47091High7.82026-05-13Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a…
CVE-2026-44612High7.82026-05-13Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directo…
CVE-2026-20772Medium6.72026-05-12Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121.193 within Ring 3: User Applications ma…
CVE-2025-365152026-05-12Uncontrolled search path for some AI Playground software before version 3.0.0 alpha within Ring 3: User Applications may allow an escalation of privilege. Unpr…
CVE-2025-359692026-05-12Uncontrolled search path for some Intel(R) Server Firmware Update Utility Software before version 16.0.12. within Ring 3: User Applications may allow an escala…
CVE-2026-45004High7.82026-05-11OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() du…
CVE-2025-69599Critical9.82026-05-08RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. NOTE: this is disp…
CVE-2026-44406Medium5.72026-05-07ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enabl…
CVE-2026-40004Medium5.52026-05-07There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate p…
CVE-2026-216612026-05-06Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue…
CVE-2026-6788High7.82026-05-06Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files.
CVE-2026-25852Medium6.72026-04-29Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.
CVE-2026-41373Medium6.12026-04-28OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted…
CVE-2026-7279High7.82026-04-28AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directo…
CVE-2026-42171High7.82026-04-24NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gai…
CVE-2026-32172High8.02026-04-23Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.
CVE-2026-34488High7.32026-04-23IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be…
CVE-2025-10549Medium5.12026-04-23EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker…
CVE-2026-32679High7.82026-04-23The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plu…
CVE-2026-40342Critical9.92026-04-17Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates…
CVE-2026-6421High7.02026-04-17A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to…
CVE-2026-22619High7.82026-04-16Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker…
CVE-2026-34632High8.62026-04-15Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context…
CVE-2026-4134High7.32026-04-15During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authentic…
CVE-2026-1636Medium6.72026-04-15A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute…
CVE-2026-5397High7.82026-04-15It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on…
CVE-2026-5055High7.82026-04-11NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affect…
CVE-2026-4158High7.32026-04-11KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalat…
CVE-2026-28704High7.82026-04-10Emocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be executed with the priv…
CVE-2026-30478High8.82026-04-09A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable.
CVE-2026-40031High7.82026-04-08MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare…
CVE-2025-14821High7.82026-04-07A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation…
CVE-2026-28728Medium6.72026-04-02Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902.
CVE-2026-27774Medium6.72026-04-02Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902.
CVE-2026-5271High7.82026-04-01pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a u…