CWE-427 · Uncontrolled Search Path Element (page 2)
Page 2 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3775 | High | 7.8 | 2026-04-01 | The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privil… |
CVE-2026-22561 | High | 7.8 | 2026-03-31 | Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via… |
CVE-2026-34054 | High | 7.8 | 2026-03-31 | vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machin… |
CVE-2026-4962 | High | 7.0 | 2026-03-27 | A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component… |
CVE-2026-28760 | High | 7.8 | 2026-03-26 | The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to place a crafted DLL wi… |
CVE-2026-26306 | High | 7.8 | 2026-03-25 | The installer for OM Workspace (Windows Edition) Ver 2.4 and earlier insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute a… |
CVE-2026-4546 | High | 7.0 | 2026-03-22 | A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can… |
CVE-2026-4545 | High | 7.0 | 2026-03-22 | A security flaw has been discovered in Flos Freeware Notepad2 4.2.25. This affects an unknown function in the library PROPSYS.dll. Performing a manipulation re… |
CVE-2026-33156 | High | 7.8 | 2026-03-20 | ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable exe… |
CVE-2025-69784 | High | 8.8 | 2026-03-16 | A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by t… |
CVE-2026-2713 | High | 7.4 | 2026-03-10 | IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontroll… |
CVE-2026-24317 | Medium | 5.0 | 2026-03-10 | SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerabili… |
CVE-2026-30896 | High | 7.8 | 2026-03-09 | The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs). When a user is directed to place some malicious DLL to th… |
CVE-2026-3787 | High | 7.0 | 2026-03-08 | A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service… |
CVE-2026-28712 | Medium | 6.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28711 | Medium | 6.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2025-11792 | High | 7.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41… |
CVE-2026-29610 | High | 8.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH enviro… |
CVE-2026-28456 | High | 7.2 | 2026-03-05 | OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths b… |
CVE-2025-15558 | High | 8.0 | 2026-03-04 | Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker… |
CVE-2026-22270 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high pr… |
CVE-2026-24502 | High | 8.8 | 2026-03-03 | Dell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local… |
CVE-2026-25191 | High | 7.8 | 2026-02-26 | The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file… |
CVE-2026-3091 | Medium | 6.7 | 2026-02-24 | An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct d… |
CVE-2026-21420 | High | 7.3 | 2026-02-23 | Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access… |
CVE-2026-2492 | High | 7.8 | 2026-02-20 | TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil… |
CVE-2026-2040 | High | 7.3 | 2026-02-20 | PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala… |
CVE-2026-26099 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26098 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26097 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26050 | High | 7.8 | 2026-02-20 | The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading… |
CVE-2026-2538 | High | 7.0 | 2026-02-16 | A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performi… |
CVE-2026-2516 | High | 7.0 | 2026-02-15 | A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDER.dll. Such manipul… |
CVE-2025-54519 | High | 7.3 | 2026-02-12 | A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2026-25676 | High | 7.8 | 2026-02-12 | The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a res… |
CVE-2026-2361 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing mali… |
CVE-2026-2360 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place mal… |
CVE-2025-52541 | High | 7.3 | 2026-02-11 | A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2025-48503 | High | 7.8 | 2026-02-11 | A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code exe… |
CVE-2025-32452 | Medium | 6.7 | 2026-02-10 | Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an escalation of privilege. Unprivileged s… |
CVE-2025-20106 | Medium | 6.7 | 2026-02-10 | Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 2025.0. within Ring 3… |
CVE-2025-15569 | High | 7.0 | 2026-02-10 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This m… |
CVE-2026-25656 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1). The affected applicatio… |
CVE-2026-25655 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper modification of a configuration file by a… |
CVE-2026-23741 | Unrated | | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/cont… |
CVE-2026-23740 | Unrated | | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredump… |
CVE-2026-24694 | High | 7.8 | 2026-02-03 | The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary… |
CVE-2026-25129 | Medium | 6.7 | 2026-01-30 | PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `… |
CVE-2025-13919 | Medium | 4.4 | 2026-01-28 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of… |
CVE-2026-21408 | High | 7.3 | 2026-01-27 | beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a r… |
CVE-2025-30248 | | 2026-01-26 | DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement… | |
CVE-2025-71178 | | 2026-01-26 | Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elev… | |
CVE-2026-0776 | High | 7.3 | 2026-01-23 | Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on a… |
CVE-2026-23755 | High | 7.3 | 2026-01-21 | D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC… |
CVE-2026-24016 | High | 7.8 | 2026-01-21 | The installer of ServerView Agents for Windows provided by Fsas Technologies Inc. may insecurely load Dynamic Link Libraries. Arbitrary code may be executed wi… |
CVE-2025-33231 | Medium | 6.7 | 2026-01-20 | NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncontrolled search path… |
CVE-2025-33229 | High | 7.3 | 2026-01-20 | NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the same privileges as the… |
CVE-2025-65118 | High | 8.8 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code… |
CVE-2022-50808 | High | 8.4 | 2026-01-13 | CoolerMaster MasterPlus 1.8.5 contains an unquoted service path vulnerability in the MPService that allows local attackers to execute code with elevated system… |
CVE-2026-21427 | High | 7.8 | 2026-01-08 | The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Li… |
CVE-2019-25268 | Critical | 9.8 | 2026-01-08 | NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files fr… |
CVE-2025-14625 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Window… |
CVE-2025-14605 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects… |
CVE-2025-14599 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on… |
CVE-2025-14596 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quar… |
CVE-2025-57836 | High | 7.8 | 2026-01-05 | An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions during installation… |
CVE-2025-66835 | High | 7.1 | 2025-12-30 | TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context. |
CVE-2025-67450 | High | 7.8 | 2025-12-26 | Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code… |
CVE-2025-59887 | High | 8.6 | 2025-12-26 | Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to… |
CVE-2025-14498 | High | 7.8 | 2025-12-23 | TradingView Desktop Electron Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privilege… |
CVE-2025-14406 | High | 7.8 | 2025-12-23 | Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-14405 | Medium | 6.8 | 2025-12-23 | PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate p… |
CVE-2023-53959 | Critical | 9.8 | 2025-12-19 | FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the appl… |
CVE-2023-53937 | High | 7.8 | 2025-12-18 | Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library… |
CVE-2025-53000 | High | 7.8 | 2025-12-17 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16… |
CVE-2025-13670 | Medium | 6.7 | 2025-12-12 | The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability |
CVE-2025-13669 | Medium | 6.7 | 2025-12-12 | Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level S… |
CVE-2025-13665 | Medium | 6.7 | 2025-12-12 | The System Console Utility for Windows is vulnerable to a DLL planting vulnerability |
CVE-2025-13668 | Medium | 6.7 | 2025-12-11 | A potential security vulnerability in Quartus® Prime Pro Edition Design Software may allow escalation of privilege. |
CVE-2025-13664 | Medium | 6.7 | 2025-12-11 | A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege. |
CVE-2025-64995 | Medium | 6.5 | 2025-12-11 | A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSe… |
CVE-2025-64994 | Medium | 6.5 | 2025-12-11 | A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. Th… |
CVE-2025-34424 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34423 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34422 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34421 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34420 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34419 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34418 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34417 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34416 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-13152 | High | 7.8 | 2025-12-10 | A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to… |
CVE-2025-12046 | High | 7.8 | 2025-12-10 | A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code… |
CVE-2025-65741 | Critical | 9.8 | 2025-12-09 | Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library… |
CVE-2025-34396 | High | 7.3 | 2025-12-09 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-5471 | High | 7.8 | 2025-12-09 | Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1. |
CVE-2025-5470 | | 2025-12-09 | Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275. | |
CVE-2025-5469 | | 2025-12-09 | Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245 | |
CVE-2025-33208 | High | 8.8 | 2025-12-03 | NVIDIA TAO contains a vulnerability where an attacker may cause a resource to be loaded via an uncontrolled search path. A successful exploit of this vulnerabi… |
CVE-2025-66476 | High | 7.8 | 2025-12-02 | Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on Windows allows Vim to execute maliciou… |