# CWE-426.

Every Advisory and CVE whose sources give the weakness CWE-426, newest first.

## Records, newest first

- [draw.io Desktop allows Windows executable search-path hijacking](https://agentprime.io/advisories/CVE-2026-119333.md)
  `CVE-2026-119333` · CVE record: jgraph drawio-desktop · CVSS 7.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-426
- [pgAdmin 4: Utility binary path can point at a shared storage directory](https://agentprime.io/advisories/CVE-2026-116243.md)
  `CVE-2026-116243` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-426, CWE-427
- [Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location](https://agentprime.io/advisories/CVE-2026-57203.md)
  `CVE-2026-57203` · CVE record: asterisk asterisk and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-426
- [Untrusted search path in Veeam Agent for Linux](https://agentprime.io/advisories/CVE-2026-105477.md)
  `CVE-2026-105477` · CVE record: Veeam Agent for Linux · CVSS 7.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-426
- [mk-oracle: Local privilege escalation via insecure Oracle Home library loading](https://agentprime.io/advisories/CVE-2026-113461.md)
  `CVE-2026-113461` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-426, CWE-829
- [An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.](https://agentprime.io/advisories/CVE-2026-95182.md)
  `CVE-2026-95182` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-426
- [GlobalProtect App: Local Privilege Escalation Vulnerability on macOS](https://agentprime.io/advisories/CVE-2026-0315.md)
  `CVE-2026-0315` · CVE record: Palo Alto Networks GlobalProtect App · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-426
- [Dimension | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-103847.md)
  `CVE-2026-103847` · CVE record: Adobe Adobe Dimension · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [Windows Setup Files Cleanup Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83509.md)
  `CVE-2026-83509` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [Servicing Stack Updates Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83506.md)
  `CVE-2026-83506` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [Windows Setup Files Cleanup Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83505.md)
  `CVE-2026-83505` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Race condition, CWE-426
- [Windows Update Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69733.md)
  `CVE-2026-69733` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [Windows Update Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69882.md)
  `CVE-2026-69882` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [Windows Update Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70142.md)
  `CVE-2026-70142` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [.NET Framework Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-108398.md)
  `CVE-2026-108398` · CVE record: Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 and 4 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [Potential Privilege Escalation in InstallShield](https://agentprime.io/advisories/CVE-2026-4869.md)
  `CVE-2026-4869` · CVE record: Flexera InstallShield · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-426
- [IBM Aspera Enterprise Webapps Untrusted Search Path](https://agentprime.io/advisories/CVE-2026-75782.md)
  `CVE-2026-75782` · CVE record: IBM Aspera Enterprise WebApps · CVSS 7.8 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-426
- [mk-oracle: Local privilege escalation via malicious Oracle Instant Client](https://agentprime.io/advisories/CVE-2026-105331.md)
  `CVE-2026-105331` · CVE record: Checkmk GmbH Checkmk · CVSS 5.2 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-426, CWE-829
- [Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend](https://agentprime.io/advisories/GHSA-p75x-jh7p-ppcx.md)
  `GHSA-p75x-jh7p-ppcx`, `CVE-2026-106505` · npm `@backstage/plugin-techdocs-node`: affected `<1.15.4`, fixed in `1.15.4` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-426, CWE-436
- [Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-104809.md)
  `CVE-2026-104809` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, CWE-426, CWE-427, CWE-494
- [Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover](https://agentprime.io/advisories/CVE-2026-59265.md)
  `CVE-2026-59265` · CVE record: Apache Software Foundation Apache OpenOffice · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-426
- [Local Privilege Escalation in Ghostscript for Windows](https://agentprime.io/advisories/CVE-2026-19547.md)
  `CVE-2026-19547` · CVE record: Artifex Software Inc. Ghostscript · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-426
- [Untrusted Search Path (PATH Hijacking) in fuse-archive](https://agentprime.io/advisories/CVE-2026-87723.md)
  `CVE-2026-87723` · CVE record: Google fuse-archive · CVSS 5.4 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-426
- [OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows](https://agentprime.io/advisories/CVE-2026-100584.md)
  `CVE-2026-100584` · CVE record: OpenClaw OpenClaw · CVSS 5.4 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-426
- [GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX](https://agentprime.io/advisories/CVE-2026-100310.md)
  `CVE-2026-100310` · CVE record: GNU libextractor · CVSS 7.3 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-426
- [Untrusted search path in WebPros Plesk and others](https://agentprime.io/advisories/CVE-2026-68492.md)
  `CVE-2026-68492` · CVE record: WebPros Plesk and 1 more · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-426
- [n8n before 1.123.76 Sandbox Escape via Git Relative URL](https://agentprime.io/advisories/CVE-2026-92587.md)
  `CVE-2026-92587` · CVE record: n8n-io n8n · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-426
- [OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS](https://agentprime.io/advisories/GHSA-v8pv-4842-x354.md)
  `GHSA-v8pv-4842-x354`, `CVE-2026-81192` · NuGet `OpenTelemetry.Resources.Host`: affected `<1.16.0-beta.2`, fixed in `1.16.0-beta.2` · CVSS 7.0 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-426
- [GlobalProtect App: Local Privilege Escalation Vulnerabilities](https://agentprime.io/advisories/CVE-2026-0307.md)
  `CVE-2026-0307` · CVE record: Palo Alto Networks GlobalProtect App · CVSS 5.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-426
- [Acrobat Reader | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-80159.md)
  `CVE-2026-80159` · CVE record: Adobe Adobe Acrobat and 2 more · CVSS 4.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-426
- [Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling](https://agentprime.io/advisories/CVE-2026-78574.md)
  `CVE-2026-78574` · CVE record: Okta Okta Hyperdrive Integration Plugin · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-426
- [Windows Smart Card Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69785.md)
  `CVE-2026-69785` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-426
- [Windows Storage Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69328.md)
  `CVE-2026-69328` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-426
- [Untrusted search path in OpenVPN](https://agentprime.io/advisories/CVE-2026-84226.md)
  `CVE-2026-84226` · CVE record: OpenVPN OpenVPN · CVSS 8.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-426
- [NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary](https://agentprime.io/advisories/GHSA-6hwm-xvph-95vm.md)
  `GHSA-6hwm-xvph-95vm`, `CVE-2026-78680`, `PYSEC-2026-3868` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 8.5 High · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-426, CWE-427
- [Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files](https://agentprime.io/advisories/CVE-2026-82862.md)
  `CVE-2026-82862` · CVE record: kerberosmansour hulumi · CVSS 8.6 High · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-426
- [openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration](https://agentprime.io/advisories/CVE-2026-81697.md)
  `CVE-2026-81697` · CVE record: jahlives openssl_encrypt · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-426
- [Substance3D - Painter | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-75768.md)
  `CVE-2026-75768` · CVE record: Adobe Substance3D - Painter · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-426
- [PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code](https://agentprime.io/advisories/GHSA-hxmv-c4g6-5fqc.md)
  `GHSA-hxmv-c4g6-5fqc`, `CVE-2026-55522`, `PYSEC-2026-3891`, `PYSEC-2026-3903` · PyPI `praisonai` and 1 more: affected `>=3.9.26, <4.6.58`, fixed in `4.6.58` · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2026 · Tags: Code injection, CWE-426, CWE-829
- [Duplicate Advisory: Uncontrolled search path when invoking the Graphviz 'dot' binary (CWE-426/CWE-427)](https://agentprime.io/advisories/GHSA-54xp-3ww7-6wjg.md)
  `GHSA-54xp-3ww7-6wjg` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-426
- [Untrusted Search Path in StackGres](https://agentprime.io/advisories/CVE-2026-78155.md)
  `CVE-2026-78155` · CVE record: OnGres StackGres · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Aug 2026 · Tags: CWE-426
- [CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed \`search_path\`](https://agentprime.io/advisories/CVE-2026-55769.md)
  `CVE-2026-55769` · CVE record: cloudnative-pg cloudnative-pg · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-426
- [Vulnerabilities in IBM AIX and PowerVM VIOS](https://agentprime.io/advisories/CVE-2026-16869.md)
  `CVE-2026-16869` · CVE record: IBM AIX and 1 more · CVSS 7.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-426
- [IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty](https://agentprime.io/advisories/CVE-2026-16674.md)
  `CVE-2026-16674` · CVE record: IBM i · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-426
- [IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-14875.md)
  `CVE-2026-14875` · CVE record: IBM i Access Client Solutions · CVSS 7.3 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-426
- [PostgreSQL amcheck does not clear untrusted search path](https://agentprime.io/advisories/CVE-2026-14673.md)
  `CVE-2026-14673` · CVE record: PostgreSQL · CVSS 3.8 Low · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-426
- [GlobalProtect App: Local Privilege Escalation Vulnerabilities](https://agentprime.io/advisories/CVE-2026-0299.md)
  `CVE-2026-0299` · CVE record: Palo Alto Networks GlobalProtect App · CVSS 5.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-426
- [Windows Narrator Braille Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-56174.md)
  `CVE-2026-56174` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-426
- [Untrusted search path in Intel(R) Performance Counter Monitor (Intel(R) PCM)](https://agentprime.io/advisories/CVE-2026-32791.md)
  `CVE-2026-32791` · CVE record: Intel(R) Performance Counter Monitor (Intel(R) PCM) · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-426
- [Untrusted search path in Battery Life Diagnostic Tool software](https://agentprime.io/advisories/CVE-2026-20799.md)
  `CVE-2026-20799` · CVE record: Battery Life Diagnostic Tool software · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-426
- [FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path](https://agentprime.io/advisories/CVE-2026-41447.md)
  `CVE-2026-41447` · CVE record: Zucchetti S.p.a. FirmaCheck · CVSS 8.5 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-426
- [CheckMAL AppCheck Pro Kernel Mini-Filter Driver AppCheckD.sys uncontrolled search path](https://agentprime.io/advisories/CVE-2026-18605.md)
  `CVE-2026-18605` · CVE record: CheckMAL AppCheck Pro · CVSS 7.3 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-426, CWE-427
- [Bridge | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-48391.md)
  `CVE-2026-48391` · CVE record: Adobe Adobe Bridge · CVSS 8.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-426
- [Bridge | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-48395.md)
  `CVE-2026-48395` · CVE record: Adobe Adobe Bridge · CVSS 8.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-426
- [AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance](https://agentprime.io/advisories/GHSA-mhww-p97m-3368.md)
  `GHSA-mhww-p97m-3368`, `CVE-2026-11400` · Maven `software.amazon.jdbc:aws-advanced-jdbc-wrapper`: affected `>=3.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 8.6 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-426
- [Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace](https://agentprime.io/advisories/CVE-2026-63093.md)
  `CVE-2026-63093` · CVE record: Anysphere, Inc. Cursor · CVSS 8.7 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-426
- [CAI Content Credentials | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-48287.md)
  `CVE-2026-48287` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 7.4 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-426
- [Illustrator | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-48275.md)
  `CVE-2026-48275` · CVE record: Adobe Illustrator Desktop 2026 and 1 more · CVSS 8.6 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-426
- [Animate | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-48346.md)
  `CVE-2026-48346` · CVE record: Adobe Adobe Animate 2023 and 1 more · CVSS 7.9 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-426
- [Microsoft XML Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-57097.md)
  `CVE-2026-57097` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.4 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-426

Older: <https://agentprime.io/advisories/tag/cwe-426.md?cursor=WyIyMDI2LTA3LTE0VDE3OjA1OjE2LjQxNzAwMFoiLCJDVkUtMjAyNi01NzA5NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-426>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-426/>. Everything for agents: <https://agentprime.io/llms.txt>.