CWE-427 · Uncontrolled Search Path Element (page 2)
Page 2 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41373 | Medium | 6.1 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted… |
CVE-2026-7279 | High | 7.8 | 2026-04-28 | AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directo… |
CVE-2026-42171 | High | 7.8 | 2026-04-24 | NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gai… |
CVE-2026-32172 | High | 8.0 | 2026-04-23 | Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network. |
CVE-2026-34488 | High | 7.3 | 2026-04-23 | IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be… |
CVE-2025-10549 | Medium | 5.1 | 2026-04-23 | EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker… |
CVE-2026-32679 | High | 7.8 | 2026-04-23 | The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plu… |
CVE-2026-40342 | Critical | 9.9 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates… |
CVE-2026-6421 | High | 7.0 | 2026-04-17 | A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to… |
CVE-2026-22619 | High | 7.8 | 2026-04-16 | Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker… |
CVE-2026-34632 | High | 8.6 | 2026-04-15 | Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context… |
CVE-2026-4134 | High | 7.3 | 2026-04-15 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authentic… |
CVE-2026-1636 | Medium | 6.7 | 2026-04-15 | A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute… |
CVE-2026-5397 | High | 7.8 | 2026-04-15 | It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on… |
CVE-2026-5055 | High | 7.8 | 2026-04-11 | NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affect… |
CVE-2026-4158 | High | 7.3 | 2026-04-11 | KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalat… |
CVE-2026-28704 | High | 7.8 | 2026-04-10 | Emocheck insecurely loads Dynamic Link Libraries (DLLs). If a crafted DLL file is placed to the same directory, an arbitrary code may be executed with the priv… |
CVE-2026-30478 | High | 8.8 | 2026-04-09 | A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable. |
CVE-2026-40031 | High | 7.8 | 2026-04-08 | MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare… |
CVE-2025-14821 | High | 7.8 | 2026-04-07 | A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation… |
CVE-2026-28728 | Medium | 6.7 | 2026-04-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902. |
CVE-2026-27774 | Medium | 6.7 | 2026-04-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902. |
CVE-2026-5271 | High | 7.8 | 2026-04-01 | pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a u… |
CVE-2026-3775 | High | 7.8 | 2026-04-01 | The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privil… |
CVE-2026-22561 | High | 7.8 | 2026-03-31 | Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via… |
CVE-2026-34054 | High | 7.8 | 2026-03-31 | vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machin… |
CVE-2026-4962 | High | 7.0 | 2026-03-27 | A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component… |
CVE-2026-28760 | High | 7.8 | 2026-03-26 | The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to place a crafted DLL wi… |
CVE-2026-26306 | High | 7.8 | 2026-03-25 | The installer for OM Workspace (Windows Edition) Ver 2.4 and earlier insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute a… |
CVE-2026-4546 | High | 7.0 | 2026-03-22 | A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can… |
CVE-2026-4545 | High | 7.0 | 2026-03-22 | A security flaw has been discovered in Flos Freeware Notepad2 4.2.25. This affects an unknown function in the library PROPSYS.dll. Performing a manipulation re… |
CVE-2026-33156 | High | 7.8 | 2026-03-20 | ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable exe… |
CVE-2025-69784 | High | 8.8 | 2026-03-16 | A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by t… |
CVE-2026-2713 | High | 7.4 | 2026-03-10 | IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontroll… |
CVE-2026-24317 | Medium | 5.0 | 2026-03-10 | SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerabili… |
CVE-2026-30896 | High | 7.8 | 2026-03-09 | The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs). When a user is directed to place some malicious DLL to th… |
CVE-2026-3787 | High | 7.0 | 2026-03-08 | A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service… |
CVE-2026-28712 | Medium | 6.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2026-28711 | Medium | 6.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. |
CVE-2025-11792 | High | 7.3 | 2026-03-06 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41… |
CVE-2026-29610 | High | 8.8 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH enviro… |
CVE-2026-28456 | High | 7.2 | 2026-03-05 | OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths b… |
CVE-2025-15558 | High | 8.0 | 2026-03-04 | Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker… |
CVE-2026-22270 | Medium | 6.7 | 2026-03-04 | Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an uncontrolled search path element vulnerability. A high pr… |
CVE-2026-24502 | High | 8.8 | 2026-03-03 | Dell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local… |
CVE-2026-25191 | High | 7.8 | 2026-02-26 | The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file… |
CVE-2026-3091 | Medium | 6.7 | 2026-02-24 | An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct d… |
CVE-2026-21420 | High | 7.3 | 2026-02-23 | Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access… |
CVE-2026-2492 | High | 7.8 | 2026-02-20 | TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privil… |
CVE-2026-2040 | High | 7.3 | 2026-02-20 | PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala… |
CVE-2026-26099 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26098 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26097 | Medium | 5.5 | 2026-02-20 | Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request. |
CVE-2026-26050 | High | 7.8 | 2026-02-20 | The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading… |
CVE-2026-2538 | High | 7.0 | 2026-02-16 | A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performi… |
CVE-2026-2516 | High | 7.0 | 2026-02-15 | A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDER.dll. Such manipul… |
CVE-2025-54519 | High | 7.3 | 2026-02-12 | A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2026-25676 | High | 7.8 | 2026-02-12 | The installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a res… |
CVE-2026-2361 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing mali… |
CVE-2026-2360 | High | 8.0 | 2026-02-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place mal… |
CVE-2025-52541 | High | 7.3 | 2026-02-11 | A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2025-48503 | High | 7.8 | 2026-02-11 | A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code exe… |
CVE-2025-32452 | Medium | 6.7 | 2026-02-10 | Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an escalation of privilege. Unprivileged s… |
CVE-2025-20106 | Medium | 6.7 | 2026-02-10 | Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 2025.0. within Ring 3… |
CVE-2025-15569 | High | 7.0 | 2026-02-10 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This m… |
CVE-2026-25656 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1). The affected applicatio… |
CVE-2026-25655 | High | 7.8 | 2026-02-10 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper modification of a configuration file by a… |
CVE-2026-23741 | Unrated | | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/cont… |
CVE-2026-23740 | Unrated | | 2026-02-06 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredump… |
CVE-2026-24694 | High | 7.8 | 2026-02-03 | The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary… |
CVE-2026-25129 | Medium | 6.7 | 2026-01-30 | PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `… |
CVE-2025-13919 | Medium | 4.4 | 2026-01-28 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of… |
CVE-2026-21408 | High | 7.3 | 2026-01-27 | beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a r… |
CVE-2025-30248 | | 2026-01-26 | DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement… | |
CVE-2025-71178 | | 2026-01-26 | Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elev… | |
CVE-2026-0776 | High | 7.3 | 2026-01-23 | Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on a… |
CVE-2026-23755 | High | 7.3 | 2026-01-21 | D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC… |
CVE-2026-24016 | High | 7.8 | 2026-01-21 | The installer of ServerView Agents for Windows provided by Fsas Technologies Inc. may insecurely load Dynamic Link Libraries. Arbitrary code may be executed wi… |
CVE-2025-33231 | Medium | 6.7 | 2026-01-20 | NVIDIA Nsight Systems for Windows contains a vulnerability in the application’s DLL loading mechanism where an attacker could cause an uncontrolled search path… |
CVE-2025-33229 | High | 7.3 | 2026-01-20 | NVIDIA Nsight Visual Studio for Windows contains a vulnerability in Nsight Monitor where an attacker can execute arbitrary code with the same privileges as the… |
CVE-2025-65118 | High | 8.8 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code… |
CVE-2022-50808 | High | 8.4 | 2026-01-13 | CoolerMaster MasterPlus 1.8.5 contains an unquoted service path vulnerability in the MPService that allows local attackers to execute code with elevated system… |
CVE-2026-21427 | High | 7.8 | 2026-01-08 | The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Li… |
CVE-2019-25268 | Critical | 9.8 | 2026-01-08 | NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files fr… |
CVE-2025-14625 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Window… |
CVE-2025-14605 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects… |
CVE-2025-14599 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on… |
CVE-2025-14596 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quar… |
CVE-2025-57836 | High | 7.8 | 2026-01-05 | An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions during installation… |
CVE-2025-66835 | High | 7.1 | 2025-12-30 | TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context. |
CVE-2025-67450 | High | 7.8 | 2025-12-26 | Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code… |
CVE-2025-59887 | High | 8.6 | 2025-12-26 | Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to… |
CVE-2025-14498 | High | 7.8 | 2025-12-23 | TradingView Desktop Electron Uncontrolled Search Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privilege… |
CVE-2025-14406 | High | 7.8 | 2025-12-23 | Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-14405 | Medium | 6.8 | 2025-12-23 | PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate p… |
CVE-2023-53959 | Critical | 9.8 | 2025-12-19 | FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the appl… |
CVE-2023-53937 | High | 7.8 | 2025-12-18 | Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library… |
CVE-2025-53000 | High | 7.8 | 2025-12-17 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16… |
CVE-2025-13670 | Medium | 6.7 | 2025-12-12 | The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability |
CVE-2025-13669 | Medium | 6.7 | 2025-12-12 | Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level S… |