Advisories · Weakness
CWE-426.
Every Advisory and CVE whose sources give the weakness CWE-426, newest first.
- CVSS 7.3 High
Mechrevo Control Console GCUService csCAPI.dll uncontrolled search path
- Mechrevo Control Console
- CWE-426
- CWE-427
- CVSS 9.3 CriticalCritical · CVSS 9+
Untrusted search path in Samba ppp
- Samba ppp
- CWE-426
- CVSS 7.8 High
Microsoft System Center Elevation of Privilege Vulnerability
- Microsoft System Center Data Protection Manager 2019
- Microsoft System Center Data Protection Manager 2022
- CWE-426
- CVSS 9.1 CriticalCritical · CVSS 9+
aiven-extras allows PostgreSQL Privilege Escalation through format function
- aiven-extras
- CWE-426
- CVSS 6.3 Medium
Untrusted search path in Acronis Cyber Protect Cloud Agent
- Acronis Cyber Protect Cloud Agent
- CWE-426
- CVSS 3.3 Low
Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection
- CWE-426
<5.11.0 · fixed in 5.11.0
GHSA-xmvv-w44w-j8wx · CVE-2025-1398 - CVSS 5.2 Medium
Untrusted search path in JetBrains Runtime
- JetBrains Runtime
- CWE-426
- CVSS 7.8 High
Illustrator | Untrusted Search Path (CWE-426)
- Adobe Illustrator
- CWE-426
- CVSS 7.3 High
Blizzard Battle.Net profapi.dll uncontrolled search path
- Blizzard Battle.Net
- CWE-426
- CWE-427
- CVSS 7.5 High
mongosh vulnerable to local privilege escalation
- CWE-426
<2.3.0 · fixed in 2.3.0
GHSA-f5w3-73h4-jpcm · CVE-2025-1756 - CVSS 7.5 High
MongoDB Compass may be susceptible to local privilege escalation in Windows
- MongoDB Inc MongoDB Compass
- CWE-426
- CVSS 7.3 High
There is a code injection vulnerability in Esri ArcGIS AllSource
- Esri ArcGIS AllSource
- CWE-426
- CVSS 6.8 Medium
Local Privilege Escalation in Rufus 4.6 and previous versions
- pbatard rufus
- CWE-426
- CWE-427
- CVSS 7.3 High
Kong Insomnia profapi.dll untrusted search path
- Kong Insomnia
- CWE-426
- CVSS 2.3 Low
Default mimetype known files writeable on Windows
- Python Software Foundation CPython
- CWE-426
- CVSS 6.3 Medium
Untrusted search path in Acronis Cyber Protect Cloud Agent
- Acronis Cyber Protect Cloud Agent
- CWE-426
- CVSS 6.3 Medium
Untrusted search path in Acronis Cyber Protect Cloud Agent
- Acronis Cyber Protect Cloud Agent
- CWE-426
- CVSS 6.3 Medium
Untrusted search path in Acronis Cyber Protect Cloud Agent
- Acronis Cyber Protect Cloud Agent
- CWE-426
- CVSS 6.3 Medium
Untrusted search path in Acronis Cyber Protect Cloud Agent
- Acronis Cyber Protect Cloud Agent
- CWE-426
- CVSS 4.6 Medium
Zoom Workplace Apps for Windows - Untrusted Search Path
- Zoom Communications, Inc Zoom Workplace Apps for Windows
- CWE-426
- CVSS 7.8 High
Snowflake JDBC allows an untrusted search path on Windows
- CWE-426
>=3.2.3, <3.22.0 · fixed in 3.22.0
GHSA-7hpq-3g6w-pvhf · CVE-2025-24789 - CVSS 2.0 Low
Postman profapi.dll untrusted search path
- Postman
- CWE-426
- CVSS 2.0 Low
Discord profapi.dll untrusted search path
- Discord
- CWE-426
- CVSS 8.5 High
Rise Group Rise Mode Temp CPU Startup CRYPTBASE.dll untrusted search path
- Rise Group Rise Mode Temp CPU
- CWE-426
- CVSS 2.0 Low
obsproject OBS Studio untrusted search path
- obsproject OBS Studio
- CWE-426
- CVSS 2.0 Low
Epic Games Launcher Installer profapi.dll untrusted search path
- Epic Games Launcher
- CWE-426
- CVSS 7.4 High
Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
- Microsoft Edge Update Setup
- CWE-426
- CVSS 8.8 High
Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422)
- Bitdefender Antivirus Free 2020
- CWE-426
- CVSS 3.3 Low
An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.
- CWE-426
- CVSS 3.3 Low
In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data.
- CWE-426
- CVSS 8.4 High
An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device.
- CWE-426
- CVSS 7.8 High
Microsoft Office Remote Code Execution Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office LTSC 2024
- CWE-426
- CVSS 7.2 High
Untrusted search path in Ivanti Endpoint Manager
- Ivanti Endpoint Manager
- Path traversal
- CWE-426
- CVSS 4.8 Medium
libretro RetroArch Startup profapi.dll untrusted search path
- libretro RetroArch
- CWE-426
- CVSS 5.8 Medium
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
- CWE-346
- CWE-426
<9.15.0 · fixed in 9.15.0
GHSA-vm32-9rqf-rh3r · CVE-2024-53866 - CVSS 7.8 High
Untrusted Search Path vulnerability in Autodesk Revit
- Autodesk Revit
- CWE-426
- CVSS 7.0 High
Untrusted search path in Veeam Agent for Windows
- Veeam Agent for Windows
- CWE-426
- CVSS 7.3 High
An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.
- CWE-426
- CVSS 7.8 High
Substance3D - Painter | Untrusted Search Path (CWE-426)
- Adobe Substance3D - Painter
- CWE-426
- CVSS 6.7 Medium
Untrusted search path in Fortinet FortiClientWindows
- Fortinet FortiClientWindows
- CWE-426
- CVSS 7.8 High
Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
- Microsoft SQL Server 2017 (GDR)
- Microsoft SQL Server 2019 (GDR)
- CWE-426
- CVSS 7.8 High
Untrusted search path in Ivanti Connect Secure and others
- Ivanti Connect Secure
- Ivanti Policy Secure
- Privilege escalation
- CWE-426
- CVSS 7.8 High
Autodesk VRED Design Privilege Escalation Vulnerability
- Autodesk VRED Design
- CWE-426
- CVSS 5.3 Medium
Code injection vulnerability found in OpenText Application Lifecycle Management (ALM),Quality Center.
- OpenText™ Application Lifecycle Management (ALM),Quality Center
- CWE-426
- CVSS 7.8 High
Adobe Framemaker | Untrusted Search Path (CWE-426)
- Adobe Framemaker
- CWE-426
- CVSS 7.8 High
Microsoft Office Remote Code Execution Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office 2019
- CWE-426
- CVSS 7.8 High
Microsoft Office Remote Code Execution Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office LTSC 2024
- CWE-426
- CVSS 8.0 High
HP One Agent Software – Potential Privilege Escalation
- HP, Inc. HP One Agent Software
- CWE-426
- CVSS 8.5 High
Intelbras InControl incontrol-service-watchdog.exe unquoted search path
- Intelbras InControl
- CWE-426
- CWE-428
- CVSS 8.4 High
Medium to High Integrity Privilege Escalation in Microsoft Windows
- Microsoft Windows 10
- Microsoft Windows 11
- CWE-426
- CWE-427
- CVSS 8.8 High
Untrusted search path in Ivanti Workspace Control
- Ivanti Workspace Control
- CWE-426
- CVSS 5.8 Medium
DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform
- SAP_SE SAP BusinessObjects Business Intelligence Platform
- CWE-426
- CVSS 8.4 High
DLL Hijacking in Yandex Browser
- Yandex Browser
- CWE-426
- CVSS 7.3 High
Untrusted search path in Dell SupportAssist for Home PCs
- Dell SupportAssist for Home PCs
- CWE-426
- CVSS 8.5 High
Scooter Software Beyond Compare 7zxa.dll uncontrolled search path
- Scooter Software Beyond Compare
- CWE-426
- CWE-427
- CVSS 6.5 Medium
Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS - Untrusted Search Path
- Zoom Communications Inc. Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS
- CWE-426
- CVSS 7.8 High
Adobe Dimension Untrusted Search Path lead to load malicious DLL swift.dll
- Adobe Dimension
- CWE-426
- CVSS 8.8 High
Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file
- Cato Networks SDP Client
- CWE-426
- CVSS 8.8 High
Cato Networks Windows SDP Client Local Privilege Escalation via self-upgrade
- Cato Networks SDP Client
- Broken access control
- CWE-426
- CVSS 7.0 High
Adobe Premiere Pro arbitrary DLL loading lead to remote code execution
- Adobe Premiere Pro
- CWE-426