# CWE-426. Every Advisory and CVE whose sources give the weakness CWE-426, newest first. ## Records, newest first (an older page) - [Mechrevo Control Console GCUService csCAPI.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2025-4272.md) `CVE-2025-4272` · CVE record: Mechrevo Control Console · CVSS 7.3 High · Not analysed yet · Published 5 May 2025 · Tags: CWE-426, CWE-427 - [Untrusted search path in Samba ppp](https://agentprime.io/advisories/CVE-2024-58250.md) `CVE-2024-58250` · CVE record: Samba ppp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2025 · Tags: CWE-426 - [Microsoft System Center Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-27743.md) `CVE-2025-27743` · CVE record: Microsoft System Center Data Protection Manager 2019 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-426 - [aiven-extras allows PostgreSQL Privilege Escalation through format function](https://agentprime.io/advisories/CVE-2025-31480.md) `CVE-2025-31480` · CVE record: aiven aiven-extras · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Apr 2025 · Tags: CWE-426 - [Untrusted search path in Acronis Cyber Protect Cloud Agent](https://agentprime.io/advisories/CVE-2025-30407.md) `CVE-2025-30407` · CVE record: Acronis Acronis Cyber Protect Cloud Agent · CVSS 6.3 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: CWE-426 - [Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection](https://agentprime.io/advisories/GHSA-xmvv-w44w-j8wx.md) `GHSA-xmvv-w44w-j8wx`, `CVE-2025-1398` · npm `mattermost-desktop`: affected `<5.11.0`, fixed in `5.11.0` · CVSS 3.3 Low · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-426 - [Untrusted search path in JetBrains Runtime](https://agentprime.io/advisories/CVE-2025-29903.md) `CVE-2025-29903` · CVE record: JetBrains Runtime · CVSS 5.2 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-426 - [Illustrator | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2025-27167.md) `CVE-2025-27167` · CVE record: Adobe Illustrator · CVSS 7.8 High · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-426 - [Blizzard Battle.Net profapi.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2025-1804.md) `CVE-2025-1804` · CVE record: Blizzard Battle.Net · CVSS 7.3 High · Not analysed yet · Published 1 Mar 2025 · Tags: CWE-426, CWE-427 - [mongosh vulnerable to local privilege escalation](https://agentprime.io/advisories/GHSA-f5w3-73h4-jpcm.md) `GHSA-f5w3-73h4-jpcm`, `CVE-2025-1756` · npm `mongosh`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-426 - [MongoDB Compass may be susceptible to local privilege escalation in Windows](https://agentprime.io/advisories/CVE-2025-1755.md) `CVE-2025-1755` · CVE record: MongoDB Inc MongoDB Compass · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-426 - [There is a code injection vulnerability in Esri ArcGIS AllSource](https://agentprime.io/advisories/CVE-2025-1068.md) `CVE-2025-1068` · CVE record: Esri ArcGIS AllSource · CVSS 7.3 High · Not analysed yet · Published 25 Feb 2025 · Tags: CWE-426 - [Local Privilege Escalation in Rufus 4.6 and previous versions](https://agentprime.io/advisories/CVE-2025-26624.md) `CVE-2025-26624` · CVE record: pbatard rufus · CVSS 6.8 Medium · Not analysed yet · Published 18 Feb 2025 · Tags: CWE-426, CWE-427 - [Kong Insomnia profapi.dll untrusted search path](https://agentprime.io/advisories/CVE-2025-1353.md) `CVE-2025-1353` · CVE record: Kong Insomnia · CVSS 7.3 High · Not analysed yet · Published 16 Feb 2025 · Tags: CWE-426 - [Default mimetype known files writeable on Windows](https://agentprime.io/advisories/CVE-2024-3220.md) `CVE-2024-3220` · CVE record: Python Software Foundation CPython · CVSS 2.3 Low · Not analysed yet · Published 14 Feb 2025 · Tags: CWE-426 - [Untrusted search path in Acronis Cyber Protect Cloud Agent](https://agentprime.io/advisories/CVE-2025-24828.md) `CVE-2025-24828` · CVE record: Acronis Acronis Cyber Protect Cloud Agent · CVSS 6.3 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-426 - [Untrusted search path in Acronis Cyber Protect Cloud Agent](https://agentprime.io/advisories/CVE-2025-24827.md) `CVE-2025-24827` · CVE record: Acronis Acronis Cyber Protect Cloud Agent · CVSS 6.3 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-426 - [Untrusted search path in Acronis Cyber Protect Cloud Agent](https://agentprime.io/advisories/CVE-2025-24829.md) `CVE-2025-24829` · CVE record: Acronis Acronis Cyber Protect Cloud Agent · CVSS 6.3 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-426 - [Untrusted search path in Acronis Cyber Protect Cloud Agent](https://agentprime.io/advisories/CVE-2025-24830.md) `CVE-2025-24830` · CVE record: Acronis Acronis Cyber Protect Cloud Agent · CVSS 6.3 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-426 - [Zoom Workplace Apps for Windows - Untrusted Search Path](https://agentprime.io/advisories/CVE-2025-0145.md) `CVE-2025-0145` · CVE record: Zoom Communications, Inc Zoom Workplace Apps for Windows · CVSS 4.6 Medium · Not analysed yet · Published 30 Jan 2025 · Tags: CWE-426 - [Snowflake JDBC allows an untrusted search path on Windows](https://agentprime.io/advisories/GHSA-7hpq-3g6w-pvhf.md) `GHSA-7hpq-3g6w-pvhf`, `CVE-2025-24789` · Maven `net.snowflake:snowflake-jdbc`: affected `>=3.2.3, <3.22.0`, fixed in `3.22.0` · CVSS 7.8 High · Not analysed yet · Published 29 Jan 2025 · Tags: CWE-426 - [Postman profapi.dll untrusted search path](https://agentprime.io/advisories/CVE-2025-0733.md) `CVE-2025-0733` · CVE record: Postman · CVSS 2.0 Low · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-426 - [Discord profapi.dll untrusted search path](https://agentprime.io/advisories/CVE-2025-0732.md) `CVE-2025-0732` · CVE record: Discord · CVSS 2.0 Low · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-426 - [Rise Group Rise Mode Temp CPU Startup CRYPTBASE.dll untrusted search path](https://agentprime.io/advisories/CVE-2025-0707.md) `CVE-2025-0707` · CVE record: Rise Group Rise Mode Temp CPU · CVSS 8.5 High · Not analysed yet · Published 24 Jan 2025 · Tags: CWE-426 - [obsproject OBS Studio untrusted search path](https://agentprime.io/advisories/CVE-2024-13524.md) `CVE-2024-13524` · CVE record: obsproject OBS Studio · CVSS 2.0 Low · Not analysed yet · Published 20 Jan 2025 · Tags: CWE-426 - [Epic Games Launcher Installer profapi.dll untrusted search path](https://agentprime.io/advisories/CVE-2025-0567.md) `CVE-2025-0567` · CVE record: Epic Games Launcher · CVSS 2.0 Low · Not analysed yet · Published 19 Jan 2025 · Tags: CWE-426 - [Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-21399.md) `CVE-2025-21399` · CVE record: Microsoft Microsoft Edge Update Setup · CVSS 7.4 High · Not analysed yet · Published 17 Jan 2025 · Tags: CWE-426 - [Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422)](https://agentprime.io/advisories/CVE-2020-8094.md) `CVE-2020-8094` · CVE record: Bitdefender Antivirus Free 2020 · CVSS 8.8 High · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-426 - [An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.](https://agentprime.io/advisories/CVE-2024-55503.md) `CVE-2024-55503` · CVE record · CVSS 3.3 Low · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-426 - [In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data.](https://agentprime.io/advisories/CVE-2024-53407.md) `CVE-2024-53407` · CVE record · CVSS 3.3 Low · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-426 - [An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device.](https://agentprime.io/advisories/CVE-2024-48123.md) `CVE-2024-48123` · CVE record · CVSS 8.4 High · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-426 - [Microsoft Office Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-21365.md) `CVE-2025-21365` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 1 more · CVSS 7.8 High · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-426 - [Untrusted search path in Ivanti Endpoint Manager](https://agentprime.io/advisories/CVE-2024-13158.md) `CVE-2024-13158` · CVE record: Ivanti Endpoint Manager · CVSS 7.2 High · Not analysed yet · Published 14 Jan 2025 · Tags: Path traversal, CWE-426 - [libretro RetroArch Startup profapi.dll untrusted search path](https://agentprime.io/advisories/CVE-2025-0459.md) `CVE-2025-0459` · CVE record: libretro RetroArch · CVSS 4.8 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-426 - [pnpm no-script global cache poisoning via overrides / \`ignore-scripts\` evasion](https://agentprime.io/advisories/GHSA-vm32-9rqf-rh3r.md) `GHSA-vm32-9rqf-rh3r`, `CVE-2024-53866` · npm `pnpm`: affected `<9.15.0`, fixed in `9.15.0` · CVSS 5.8 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-346, CWE-426 - [Untrusted Search Path vulnerability in Autodesk Revit](https://agentprime.io/advisories/CVE-2024-11454.md) `CVE-2024-11454` · CVE record: Autodesk Revit · CVSS 7.8 High · Not analysed yet · Published 9 Dec 2024 · Tags: CWE-426 - [Untrusted search path in Veeam Agent for Windows](https://agentprime.io/advisories/CVE-2024-45207.md) `CVE-2024-45207` · CVE record: Veeam Agent for Windows · CVSS 7.0 High · Not analysed yet · Published 4 Dec 2024 · Tags: CWE-426 - [An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.](https://agentprime.io/advisories/CVE-2024-50986.md) `CVE-2024-50986` · CVE record · CVSS 7.3 High · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-426 - [Substance3D - Painter | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2024-49515.md) `CVE-2024-49515` · CVE record: Adobe Substance3D - Painter · CVSS 7.8 High · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-426 - [Untrusted search path in Fortinet FortiClientWindows](https://agentprime.io/advisories/CVE-2024-36507.md) `CVE-2024-36507` · CVE record: Fortinet FortiClientWindows · CVSS 6.7 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-426 - [Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-49043.md) `CVE-2024-49043` · CVE record: Microsoft Microsoft SQL Server 2017 (GDR) and 4 more · CVSS 7.8 High · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-426 - [Untrusted search path in Ivanti Connect Secure and others](https://agentprime.io/advisories/CVE-2024-47906.md) `CVE-2024-47906` · CVE record: Ivanti Connect Secure and 1 more · CVSS 7.8 High · Not analysed yet · Published 12 Nov 2024 · Tags: Privilege escalation, CWE-426 - [Autodesk VRED Design Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2024-7995.md) `CVE-2024-7995` · CVE record: Autodesk VRED Design · CVSS 7.8 High · Not analysed yet · Published 5 Nov 2024 · Tags: CWE-426 - [Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.](https://agentprime.io/advisories/CVE-2023-32266.md) `CVE-2023-32266` · CVE record: OpenText™ Application Lifecycle Management (ALM),Quality Center · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2024 · Tags: CWE-426 - [Adobe Framemaker | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2024-47422.md) `CVE-2024-47422` · CVE record: Adobe Adobe Framemaker · CVSS 7.8 High · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-426 - [Microsoft Office Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-43616.md) `CVE-2024-43616` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 3 more · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-426 - [Microsoft Office Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-43576.md) `CVE-2024-43576` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 1 more · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-426 - [HP One Agent Software – Potential Privilege Escalation](https://agentprime.io/advisories/CVE-2024-8733.md) `CVE-2024-8733` · CVE record: HP, Inc. HP One Agent Software · CVSS 8.0 High · Not analysed yet · Published 2 Oct 2024 · Tags: CWE-426 - [Intelbras InControl incontrol-service-watchdog.exe unquoted search path](https://agentprime.io/advisories/CVE-2024-9325.md) `CVE-2024-9325` · CVE record: Intelbras InControl · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2024 · Tags: CWE-426, CWE-428 - [Medium to High Integrity Privilege Escalation in Microsoft Windows](https://agentprime.io/advisories/CVE-2024-6769.md) `CVE-2024-6769` · CVE record: Microsoft Windows 10 and 4 more · CVSS 8.4 High · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-426, CWE-427 - [Untrusted search path in Ivanti Workspace Control](https://agentprime.io/advisories/CVE-2024-44103.md) `CVE-2024-44103` · CVE record: Ivanti Workspace Control · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-426 - [DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform](https://agentprime.io/advisories/CVE-2024-45281.md) `CVE-2024-45281` · CVE record: SAP_SE SAP BusinessObjects Business Intelligence Platform · CVSS 5.8 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-426 - [DLL Hijacking in Yandex Browser](https://agentprime.io/advisories/CVE-2024-6473.md) `CVE-2024-6473` · CVE record: Yandex Browser · CVSS 8.4 High · Not analysed yet · Published 3 Sept 2024 · Tags: CWE-426 - [Untrusted search path in Dell SupportAssist for Home PCs](https://agentprime.io/advisories/CVE-2024-38305.md) `CVE-2024-38305` · CVE record: Dell SupportAssist for Home PCs · CVSS 7.3 High · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-426 - [Scooter Software Beyond Compare 7zxa.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2024-7886.md) `CVE-2024-7886` · CVE record: Scooter Software Beyond Compare · CVSS 8.5 High · Not analysed yet · Published 16 Aug 2024 · Tags: CWE-426, CWE-427 - [Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS - Untrusted Search Path](https://agentprime.io/advisories/CVE-2024-42439.md) `CVE-2024-42439` · CVE record: Zoom Communications Inc. Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS · CVSS 6.5 Medium · Not analysed yet · Published 14 Aug 2024 · Tags: CWE-426 - [Adobe Dimension Untrusted Search Path lead to load malicious DLL swift.dll](https://agentprime.io/advisories/CVE-2024-41865.md) `CVE-2024-41865` · CVE record: Adobe Dimension · CVSS 7.8 High · Not analysed yet · Published 14 Aug 2024 · Tags: CWE-426 - [Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file](https://agentprime.io/advisories/CVE-2024-6975.md) `CVE-2024-6975` · CVE record: Cato Networks SDP Client · CVSS 8.8 High · Not analysed yet · Published 31 Jul 2024 · Tags: CWE-426 - [Cato Networks Windows SDP Client Local Privilege Escalation via self-upgrade](https://agentprime.io/advisories/CVE-2024-6974.md) `CVE-2024-6974` · CVE record: Cato Networks SDP Client · CVSS 8.8 High · Not analysed yet · Published 31 Jul 2024 · Tags: Broken access control, CWE-426 - [Adobe Premiere Pro arbitrary DLL loading lead to remote code execution](https://agentprime.io/advisories/CVE-2024-34123.md) `CVE-2024-34123` · CVE record: Adobe Premiere Pro · CVSS 7.0 High · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-426 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .