# CWE-427. Every Advisory and CVE whose sources give the weakness CWE-427, newest first. ## Records, newest first (an older page) - [DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview](https://agentprime.io/advisories/CVE-2026-44406.md) `CVE-2026-44406` · CVE record: ZTE ZXCLOUD iRAI · CVSS 5.7 Medium · Not analysed yet · Published 7 May 2026 · Tags: CWE-427 - [openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview](https://agentprime.io/advisories/CVE-2026-40004.md) `CVE-2026-40004` · CVE record: ZTE ZXCLOUD iRAI · CVSS 5.5 Medium · Not analysed yet · Published 7 May 2026 · Tags: CWE-427 - [AC2000 Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2026-21661.md) `CVE-2026-21661` · CVE record: Johnson Controls AC2000 · CVSS 8.4 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-427 - [Uncontrolled search path in PluginLauncher allows SYSTEM code execution in WatchGuard Agent](https://agentprime.io/advisories/CVE-2026-6788.md) `CVE-2026-6788` · CVE record: WatchGuard WatchGuard Agent · CVSS 8.5 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-427 - [OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution](https://agentprime.io/advisories/GHSA-r39h-4c2p-3jxp.md) `GHSA-r39h-4c2p-3jxp`, `CVE-2026-45004` · npm `openclaw`: affected `<2026.4.23`, fixed in `2026.4.23` · CVSS 8.4 High · Not analysed yet · Published 5 May 2026 · Tags: Code injection, CWE-427 - [OpenClaw: Workspace dotenv files cannot override connector endpoint hosts](https://agentprime.io/advisories/GHSA-55cf-xx38-4p9p.md) `GHSA-55cf-xx38-4p9p`, `CVE-2026-45003` · npm `openclaw`: affected `<2026.4.22`, fixed in `2026.4.22` · CVSS 4.1 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-427, CWE-441, CWE-610 - [Uncontrolled search path in Acronis DeviceLock DLP](https://agentprime.io/advisories/CVE-2026-25852.md) `CVE-2026-25852` · CVE record: Acronis Acronis DeviceLock DLP · CVSS 6.7 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-427 - [eMPIA Technology｜AVACAST - DLL Hijacking](https://agentprime.io/advisories/CVE-2026-7279.md) `CVE-2026-7279` · CVE record: eMPIA Technology AVACAST · CVSS 8.5 High · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-427 - [OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config](https://agentprime.io/advisories/GHSA-mj59-h3q9-ghfh.md) `GHSA-mj59-h3q9-ghfh`, `CVE-2026-44995` · npm `openclaw`: affected `<2026.4.20`, fixed in `2026.4.20` · CVSS 5.4 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: CWE-427, CWE-454, CWE-829 - [Uncontrolled search path in Nullsoft Scriptable Install System](https://agentprime.io/advisories/CVE-2026-42171.md) `CVE-2026-42171` · CVE record: Nullsoft Nullsoft Scriptable Install System · CVSS 7.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-427 - [Microsoft Power Apps Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-32172.md) `CVE-2026-32172` · CVE record: Microsoft Microsoft Power Apps · CVSS 8.0 High · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-427 - [DLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation](https://agentprime.io/advisories/CVE-2025-10549.md) `CVE-2025-10549` · CVE record: EfficientLab, LLC Controlio · CVSS 5.1 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-427 - [Uncontrolled search path in i-PRO Co., Ltd. IP Setting Software](https://agentprime.io/advisories/CVE-2026-34488.md) `CVE-2026-34488` · CVE record: i-PRO Co., Ltd. IP Setting Software · CVSS 7.0 High · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-427 - [Uncontrolled search path in Japan Media Systems Corporation Downloader5Installer.exe and others](https://agentprime.io/advisories/CVE-2026-32679.md) `CVE-2026-32679` · CVE record: Japan Media Systems Corporation Downloader5Installer.exe and 3 more · CVSS 8.4 High · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-427 - [Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-40342.md) `CVE-2026-40342` · CVE record: FirebirdSQL firebird · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Path traversal, Code injection, CWE-427 - [Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-6421.md) `CVE-2026-6421` · CVE record: Mobatek MobaXterm Home Edition · CVSS 7.3 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-426, CWE-427 - [Uncontrolled search path in Eaton IPP software](https://agentprime.io/advisories/CVE-2026-22619.md) `CVE-2026-22619` · CVE record: Eaton IPP software · CVSS 7.8 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-427 - [Photoshop Installer | CWE-427: Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2026-34632.md) `CVE-2026-34632` · CVE record: Adobe Adobe Photoshop Installer · CVSS 8.6 High · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-427 - [Uncontrolled search path in Lenovo Software Fix](https://agentprime.io/advisories/CVE-2026-4134.md) `CVE-2026-4134` · CVE record: Lenovo Software Fix · CVSS 7.0 High · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-427 - [Uncontrolled search path in Lenovo Service Bridge](https://agentprime.io/advisories/CVE-2026-1636.md) `CVE-2026-1636` · CVE record: Lenovo Service Bridge · CVSS 5.4 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-427 - [Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application](https://agentprime.io/advisories/CVE-2026-5397.md) `CVE-2026-5397` · CVE record: OMRON SOCIAL SOLUTIONS CO., Ltd. PowerAttendant Standard Edition · CVSS 7.8 High · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-427 - [KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-4158.md) `CVE-2026-4158` · CVE record: KeePassXC KeePassXC · CVSS 7.3 High · Not analysed yet · Published 11 Apr 2026 · Tags: CWE-427 - [NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-5055.md) `CVE-2026-5055` · CVE record: NoMachine NoMachine · CVSS 7.8 High · Not analysed yet · Published 11 Apr 2026 · Tags: CWE-427 - [Uncontrolled search path in Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) Emocheck](https://agentprime.io/advisories/CVE-2026-28704.md) `CVE-2026-28704` · CVE record: Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) Emocheck · CVSS 8.4 High · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-427 - [A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable.](https://agentprime.io/advisories/CVE-2026-30478.md) `CVE-2026-30478` · CVE record · CVSS 8.8 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-427 - [MemProcFS < 5.17 DLL/Shared Library Hijacking](https://agentprime.io/advisories/CVE-2026-40031.md) `CVE-2026-40031` · CVE record: ufrisk MemProcFS · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-427 - [Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows](https://agentprime.io/advisories/CVE-2025-14821.md) `CVE-2025-14821` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 7.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-427 - [OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides](https://agentprime.io/advisories/GHSA-g8xp-qx39-9jq9.md) `GHSA-g8xp-qx39-9jq9`, `CVE-2026-41373` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 5.8 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-427 - [Uncontrolled search path in Acronis True Image](https://agentprime.io/advisories/CVE-2026-27774.md) `CVE-2026-27774` · CVE record: Acronis Acronis True Image · CVSS 6.7 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-427 - [Uncontrolled search path in Acronis True Image](https://agentprime.io/advisories/CVE-2026-28728.md) `CVE-2026-28728` · CVE record: Acronis Acronis True Image · CVSS 6.7 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-427 - [Possible to hijack modules in current working directory](https://agentprime.io/advisories/CVE-2026-5271.md) `CVE-2026-5271` · CVE record: Python Software Foundation pymanager · CVSS 5.6 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-427 - [Foxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-3775.md) `CVE-2026-3775` · CVE record: Foxit Software Inc. Foxit PDF Editor and 1 more · CVSS 7.8 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-427 - [openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification](https://agentprime.io/advisories/GHSA-j48q-4c78-rhf9.md) `GHSA-j48q-4c78-rhf9`, `CVE-2026-74872`, `PYSEC-2026-3742` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-426, CWE-427 - [Uncontrolled search path in Anthropic Claude Desktop - Windows](https://agentprime.io/advisories/CVE-2026-22561.md) `CVE-2026-22561` · CVE record: Anthropic Claude Desktop - Windows · CVSS 4.7 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-427 - [openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)](https://agentprime.io/advisories/CVE-2026-34054.md) `CVE-2026-34054` · CVE record: microsoft vcpkg · CVSS 7.8 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-427 - [UltraVNC Service version.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-4962.md) `CVE-2026-4962` · CVE record: UltraVNC · CVSS 7.3 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-426, CWE-427 - [Uncontrolled search path in RATOC Systems, Inc. RATOC RAID Monitoring Manager for Windows](https://agentprime.io/advisories/CVE-2026-28760.md) `CVE-2026-28760` · CVE record: RATOC Systems, Inc. RATOC RAID Monitoring Manager for Windows · CVSS 8.4 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-427 - [Uncontrolled search path in OM Digital Solutions Corporation OM Workspace (Windows Edition)](https://agentprime.io/advisories/CVE-2026-26306.md) `CVE-2026-26306` · CVE record: OM Digital Solutions Corporation OM Workspace (Windows Edition) · CVSS 8.4 High · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-427 - [Flos Freeware Notepad2 TextShaping.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-4546.md) `CVE-2026-4546` · CVE record: Flos Freeware Notepad2 · CVSS 7.3 High · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-426, CWE-427 - [Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-4545.md) `CVE-2026-4545` · CVE record: Flos Freeware Notepad2 · CVSS 7.3 High · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-426, CWE-427 - [DLL Sideloading in ScreenToGif](https://agentprime.io/advisories/CVE-2026-33156.md) `CVE-2026-33156` · CVE record: NickeManarin ScreenToGif · CVSS 7.8 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-426, CWE-427 - [A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by the product.](https://agentprime.io/advisories/CVE-2025-69784.md) `CVE-2025-69784` · CVE record · CVSS 8.8 High · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-427 - [IBM Trusteer Rapport installer affected by uncontrolled search path element vulnerability](https://agentprime.io/advisories/CVE-2026-2713.md) `CVE-2026-2713` · CVE record: IBM Trusteer Rapport installer · CVSS 7.4 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-427 - [DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT](https://agentprime.io/advisories/CVE-2026-24317.md) `CVE-2026-24317` · CVE record: SAP_SE SAP GUI for Windows with active GuiXT · CVSS 5.0 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-427 - [Uncontrolled search path in Qsee Client](https://agentprime.io/advisories/CVE-2026-30896.md) `CVE-2026-30896` · CVE record: Qsee Qsee Client · CVSS 8.4 High · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-427 - [UltraVNC Windows Service cryptbase.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-3787.md) `CVE-2026-3787` · CVE record: UltraVNC · CVSS 7.3 High · Not analysed yet · Published 8 Mar 2026 · Tags: CWE-426, CWE-427 - [Uncontrolled search path in Acronis Cyber Protect 17](https://agentprime.io/advisories/CVE-2026-28712.md) `CVE-2026-28712` · CVE record: Acronis Acronis Cyber Protect 17 · CVSS 6.3 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-427 - [Uncontrolled search path in Acronis Cyber Protect 17](https://agentprime.io/advisories/CVE-2026-28711.md) `CVE-2026-28711` · CVE record: Acronis Acronis Cyber Protect 17 · CVSS 6.3 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-427 - [Uncontrolled search path in Acronis Cyber Protect Cloud Agent](https://agentprime.io/advisories/CVE-2025-11792.md) `CVE-2025-11792` · CVE record: Acronis Acronis Cyber Protect Cloud Agent · CVSS 7.3 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-427 - [Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows](https://agentprime.io/advisories/GHSA-p436-gjf2-799p.md) `GHSA-p436-gjf2-799p`, `BIT-docker-cli-2025-15558`, `CVE-2025-15558`, `GO-2026-4610` · Go `github.com/docker/cli`: affected `>=19.03.0, <29.2.0`, fixed in `29.2.0` · CVSS 7.0 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-427 - [Uncontrolled search path in Dell PowerScale OneFS,](https://agentprime.io/advisories/CVE-2026-22270.md) `CVE-2026-22270` · CVE record: Dell PowerScale OneFS, · CVSS 6.7 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-427 - [Uncontrolled search path in Dell Command | Intel vPro Out of Band](https://agentprime.io/advisories/CVE-2026-24502.md) `CVE-2026-24502` · CVE record: Dell Dell Command | Intel vPro Out of Band · CVSS 8.8 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-427 - [OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading](https://agentprime.io/advisories/GHSA-7xhj-55q9-pc3m.md) `GHSA-7xhj-55q9-pc3m`, `CVE-2026-28393` · npm `openclaw`: affected `>=2.0.0-beta3, <2026.2.14`, fixed in `2026.2.14` · CVSS 8.3 High · Not analysed yet · Published 3 Mar 2026 · Tags: Path traversal, CWE-427 - [Uncontrolled search path in Digital Arts Inc. FinalCode Ver.5 series and others](https://agentprime.io/advisories/CVE-2026-25191.md) `CVE-2026-25191` · CVE record: Digital Arts Inc. FinalCode Ver.5 series and 1 more · CVSS 8.4 High · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-427 - [Uncontrolled search path in Synology Presto Client](https://agentprime.io/advisories/CVE-2026-3091.md) `CVE-2026-3091` · CVE record: Synology Synology Presto Client · CVSS 6.7 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-427 - [Uncontrolled search path in Dell Repository Manager](https://agentprime.io/advisories/CVE-2026-21420.md) `CVE-2026-21420` · CVE record: Dell Repository Manager · CVSS 7.3 High · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-427 - [TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-2492.md) `CVE-2026-2492` · CVE record: TensorFlow TensorFlow · CVSS 7.0 High · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-427 - [PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-2040.md) `CVE-2026-2040` · CVE record: PDF-XChange PDF-XChange Editor · CVSS 7.3 High · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-427 - [Uncontrolled Search Path Element in Owl opds](https://agentprime.io/advisories/CVE-2026-26099.md) `CVE-2026-26099` · CVE record: Owl opds · CVSS 8.4 High · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-427 - [Uncontrolled Search Path Element in Owl opds](https://agentprime.io/advisories/CVE-2026-26098.md) `CVE-2026-26098` · CVE record: Owl opds · CVSS 8.4 High · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-427 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .