CWE-427 · Uncontrolled Search Path Element (page 4)
Page 4 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-7676 | | 2025-07-28 | DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL… | |
CVE-2024-13976 | | 2025-07-25 | A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates… | |
CVE-2025-7427 | Medium | 5.9 | 2025-07-22 | Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could l… |
CVE-2025-1729 | Medium | 6.7 | 2025-07-17 | A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privilege… |
CVE-2025-1700 | High | 7.0 | 2025-07-17 | A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate pr… |
CVE-2025-7472 | High | 7.5 | 2025-07-17 | A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges… |
CVE-2025-34109 | | 2025-07-15 | PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validatio… | |
CVE-2025-48496 | Medium | 5.1 | 2025-07-11 | Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of uninte… |
CVE-2025-36004 | High | 8.8 | 2025-06-25 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious acto… |
CVE-2025-49144 | High | 7.3 | 2025-06-23 | Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 instal… |
CVE-2025-4981 | Critical | 9.9 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extract… |
CVE-2024-24916 | Medium | 6.5 | 2025-06-19 | Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin). |
CVE-2025-5981 | Medium | 6.5 | 2025-06-18 | Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container ima… |
CVE-2025-49487 | Medium | 6.8 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical a… |
CVE-2025-49158 | Medium | 6.7 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installa… |
CVE-2025-49155 | High | 8.8 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to a… |
CVE-2025-33122 | High | 7.5 | 2025-06-17 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A mali… |
CVE-2025-49148 | High | 7.3 | 2025-06-11 | ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows uses the default Windows DLL search orde… |
CVE-2025-5480 | High | 7.8 | 2025-06-06 | Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2025-30167 | High | 7.3 | 2025-06-03 | Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRA… |
CVE-2024-42191 | Medium | 6.5 | 2025-05-30 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace the application wi… |
CVE-2024-42190 | Medium | 6.5 | 2025-05-30 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application wi… |
CVE-2025-5180 | High | 7.0 | 2025-05-26 | A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the l… |
CVE-2025-5129 | High | 7.0 | 2025-05-24 | A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in… |
CVE-2024-13946 | Medium | 6.8 | 2025-05-22 | DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue… |
CVE-2025-2272 | High | 7.0 | 2025-05-22 | Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issu… |
CVE-2025-27997 | High | 8.4 | 2025-05-21 | An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData… |
CVE-2025-4769 | High | 7.0 | 2025-05-16 | A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The m… |
CVE-2025-43553 | High | 7.8 | 2025-05-13 | Substance3D - Modeler versions 1.21.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code executi… |
CVE-2025-21099 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2025-20108 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4 may allow an authenticated user to pote… |
CVE-2025-20079 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Advisor software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2025-20043 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2025-20041 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics software for Intel(R) Arc™ graphics and Intel(R) Iris(R) Xe graphics before version 32.0.101.6325/32.0.101… |
CVE-2025-20015 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path element for some Intel(R) Ethernet Connection software before version 29.4 may allow an authenticated user to potentially enable escal… |
CVE-2024-47800 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local acc… |
CVE-2024-47795 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an authenticated user to potentially enable esc… |
CVE-2024-46895 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an authenticated user t… |
CVE-2024-39833 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-31073 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2023-31358 | High | 7.3 | 2025-05-13 | A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code exe… |
CVE-2025-32917 | High | 8.8 | 2025-05-13 | Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with write access t… |
CVE-2025-35471 | High | 7.3 | 2025-05-13 | conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by no… |
CVE-2025-4539 | High | 7.0 | 2025-05-11 | A vulnerability was found in Hainan ToDesk 4.7.6.3. It has been declared as critical. This vulnerability affects unknown code in the library profapi.dll of the… |
CVE-2025-4532 | High | 7.0 | 2025-05-11 | A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in th… |
CVE-2025-4525 | High | 7.0 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the l… |
CVE-2025-4455 | High | 7.0 | 2025-05-09 | A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library a… |
CVE-2025-4272 | High | 7.0 | 2025-05-05 | A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the libr… |
CVE-2025-23177 | High | 7.6 | 2025-04-29 | CWE-427: Uncontrolled Search Path Element |
CVE-2025-2769 | High | 7.8 | 2025-04-23 | Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-2768 | High | 7.8 | 2025-04-23 | Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-43950 | High | 7.8 | 2025-04-22 | DPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a directory (in the absence of a legitimate DLL), which is then lo… |
CVE-2024-12530 | | 2025-04-17 | Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager… | |
CVE-2025-32780 | High | 7.3 | 2025-04-15 | BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By… |
CVE-2025-29817 | Medium | 5.7 | 2025-04-15 | Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. |
CVE-2025-29803 | High | 7.3 | 2025-04-12 | Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges l… |
CVE-2025-2630 | High | 7.3 | 2025-04-09 | There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution… |
CVE-2025-2629 | High | 7.3 | 2025-04-09 | There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may re… |
CVE-2025-29802 | High | 7.3 | 2025-04-08 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-22458 | High | 7.8 | 2025-04-08 | DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System. |
CVE-2024-11859 | | 2025-04-07 | DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its… | |
CVE-2025-3051 | Medium | 6.5 | 2025-04-01 | Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker… |
CVE-2025-30673 | Medium | 6.5 | 2025-04-01 | Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker… |
CVE-2025-30672 | Medium | 6.5 | 2025-04-01 | Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can plac… |
CVE-2025-26631 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2025-25003 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-24998 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2020-23438 | High | 7.8 | 2025-03-04 | Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation. |
CVE-2024-10930 | High | 7.8 | 2025-03-04 | An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated… |
CVE-2025-1804 | High | 7.0 | 2025-03-01 | A vulnerability was found in Blizzard Battle.Net up to 2.39.0.15212 on Windows and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-55898 | High | 8.5 | 2025-02-24 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library c… |
CVE-2022-28339 | High | 7.3 | 2025-02-22 | Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker wit… |
CVE-2025-1223 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2025-26624 | | 2025-02-18 | Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attac… | |
CVE-2024-57964 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose inform… |
CVE-2024-57963 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in USB-CONVERTERCABLE DRIVER, which could allow local attackers to potentially disclose informa… |
CVE-2024-47006 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) 10 all versions may allow an authenticat… |
CVE-2024-42492 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.0002 may allow a privi… |
CVE-2024-42405 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to potentially enable… |
CVE-2024-39813 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2024-39372 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the Intel(R) XTU software for Windows before version 7.14.2.14 may allow an authenticated user to potentially enable escalation of… |
CVE-2024-39365 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the FPGA Support Package for the Intel(R) oneAPI DPC++/C++ Compiler software for Windows before version 2024.2 may allow an authen… |
CVE-2024-39284 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-36291 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may allow an authenticated user to potentially… |
CVE-2024-36283 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authenticated user to potentially enable escala… |
CVE-2024-36280 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an authenticated user to potentially enable esc… |
CVE-2024-32938 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authenticated user to potentially enable escala… |
CVE-2024-29223 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalatio… |
CVE-2024-24852 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow an authenticated user to potentially ena… |
CVE-2024-21830 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2023-31361 | High | 7.3 | 2025-02-11 | A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privilege escalation pot… |
CVE-2025-24039 | High | 7.3 | 2025-02-11 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2025-21206 | High | 7.3 | 2025-02-11 | Visual Studio Installer Elevation of Privilege Vulnerability |
CVE-2024-53977 | Medium | 6.7 | 2025-02-11 | A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example setup script contained in affected applic… |
CVE-2024-48091 | High | 7.8 | 2025-02-07 | Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to exe… |
CVE-2024-57426 | High | 7.3 | 2025-02-06 | NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a directory where the appl… |
CVE-2024-2658 | | 2025-01-30 | A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent… | |
CVE-2024-9499 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary… |
CVE-2024-9498 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code… |
CVE-2024-9497 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary cod… |