# CWE-428.

Every Advisory and CVE whose sources give the weakness CWE-428, newest first.

## Records, newest first

- [Unquoted search path in Dell OS Recovery tool](https://agentprime.io/advisories/CVE-2026-82155.md)
  `CVE-2026-82155` · CVE record: Dell OS Recovery tool · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-428
- [Unquoted search path in Yamaha Corporation YMS-VPN8 and others](https://agentprime.io/advisories/CVE-2026-97860.md)
  `CVE-2026-97860` · CVE record: Yamaha Corporation YMS-VPN8 and 1 more · CVSS 8.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-428
- [Path Traversal Vulnerability](https://agentprime.io/advisories/CVE-2026-15358.md)
  `CVE-2026-15358` · CVE record: Zohocorp ManageEngine OpManager and 1 more · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-428
- [Unquoted search path in Dell Inventory Collector Client](https://agentprime.io/advisories/CVE-2026-81469.md)
  `CVE-2026-81469` · CVE record: Dell Inventory Collector Client · CVSS 7.8 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-428
- [Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation](https://agentprime.io/advisories/CVE-2026-57223.md)
  `CVE-2026-57223` · CVE record: OISF suricata · CVSS 7.0 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-428
- [Maono Link local privilege escalation](https://agentprime.io/advisories/CVE-2026-77827.md)
  `CVE-2026-77827` · CVE record: Maono Maono Link · CVSS 8.4 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-428
- [Unquoted search path in Integrated Systems Technologies, Inc. NetKids iMark](https://agentprime.io/advisories/CVE-2026-66839.md)
  `CVE-2026-66839` · CVE record: Integrated Systems Technologies, Inc. NetKids iMark · CVSS 8.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-428
- [GV-ASManager DLL hijacking vulnerability](https://agentprime.io/advisories/CVE-2026-18755.md)
  `CVE-2026-18755` · CVE record: GeoVision Inc. GV-ASManager · CVSS 7.3 High · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-428
- [Studio 5000 Logix Designer® – Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-9128.md)
  `CVE-2026-9128` · CVE record: Rockwell Automation Studio 5000 Logix Designer · CVSS 7.3 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-428
- [HP Fan Control App – Potential Escalation of Privilege](https://agentprime.io/advisories/CVE-2026-8864.md)
  `CVE-2026-8864` · CVE record: HP Inc. HP Fan Control App · CVSS 7.3 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-428
- [AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2025-71326.md)
  `CVE-2025-71326` · CVE record: Avast AVAST Antivirus · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Chromacam 4.0.3.0 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2023-54353.md)
  `CVE-2023-54353` · CVE record: Personifyinc Chromacam · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Malwarebytes 4.5 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2022-50971.md)
  `CVE-2022-50971` · CVE record: Malwarebytes Malwarebytes · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Brother SAPSprint 7.60 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2021-47985.md)
  `CVE-2021-47985` · CVE record: Brother SAPSprint · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Wondershare PDFelement 5.2.9 Privilege Escalation via Unquoted Service Path](https://agentprime.io/advisories/CVE-2020-37254.md)
  `CVE-2020-37254` · CVE record: Wondershare PDFelement · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Winstep 18.06.0096 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37253.md)
  `CVE-2020-37253` · CVE record: Winstep Winstep · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Realtek Audio Service 1.0.0.55 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37252.md)
  `CVE-2020-37252` · CVE record: Realtek Realtek Audio Service · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [RealTimes Desktop Service 18.1.4 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37251.md)
  `CVE-2020-37251` · CVE record: Real RealTimes Desktop Service · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [TFTP Broadband 4.3.0.1465 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37250.md)
  `CVE-2020-37250` · CVE record: Weird-Solutions TFTP Broadband · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Network Inventory Advisor 5.0.26.0 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2019-25747.md)
  `CVE-2019-25747` · CVE record: Network-Inventory-Advisor Network Inventory Advisor · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Matrix42 Remote Control Host 3.20.0031 Unquoted Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20095.md)
  `CVE-2016-20095` · CVE record: Matrix42 Matrix42 Remote Control Host · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege](https://agentprime.io/advisories/CVE-2016-20094.md)
  `CVE-2016-20094` · CVE record: Anydesk AnyDesk · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Wise Care 365 4.27 and Wise Disk Cleaner 9.29 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20093.md)
  `CVE-2016-20093` · CVE record: Wisecleaner Wise Care 365 and 1 more · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [NetDrive 2.6.12 Unquoted Service Path Elevation of Privilege](https://agentprime.io/advisories/CVE-2016-20092.md)
  `CVE-2016-20092` · CVE record: Netdrive NetDrive · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Windows Firewall Control 4.8.6.0 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20091.md)
  `CVE-2016-20091` · CVE record: Binisoft Windows Firewall Control · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Comodo Dragon Browser 52.15.25.663 Privilege Escalation via Unquoted Service Path](https://agentprime.io/advisories/CVE-2016-20090.md)
  `CVE-2016-20090` · CVE record: Comodo Dragon Browser · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Iperius Remote 1.7.0 Unquoted Service Path Elevation of Privilege](https://agentprime.io/advisories/CVE-2016-20089.md)
  `CVE-2016-20089` · CVE record: Iperiusremote Iperius Remote · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Comodo Chromodo Browser 52.15.25.664 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20088.md)
  `CVE-2016-20088` · CVE record: Comodo Chromodo Browser · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Fortitude HTTP 1.0.4.0 Unquoted Service Path Elevation of Privilege](https://agentprime.io/advisories/CVE-2016-20087.md)
  `CVE-2016-20087` · CVE record: Networkdls Fortitude HTTP · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Vembu StoreGrid 4.0 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20086.md)
  `CVE-2016-20086` · CVE record: Vembu Vembu StoreGrid · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Realtek High Definition Audio Driver 6.0.1.6730 Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20085.md)
  `CVE-2016-20085` · CVE record: Realtek Realtek High Definition Audio Driver · CVSS 8.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-428
- [Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec](https://agentprime.io/advisories/CVE-2026-25865.md)
  `CVE-2026-25865` · CVE record: Yandex Punto Switcher · CVSS 8.5 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-428
- [VX Search 13.5.28 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2021-47974.md)
  `CVE-2021-47974` · CVE record: Vxsearch VX Search · CVSS 8.5 High · Not analysed yet · Published 16 May 2026 · Tags: CWE-428
- [Kite 4.2.0.1 U1 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37247.md)
  `CVE-2020-37247` · CVE record: Kite Kite · CVSS 8.5 High · Not analysed yet · Published 16 May 2026 · Tags: CWE-428
- [Advanced System Care Service 13.0.0.157 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37232.md)
  `CVE-2020-37232` · CVE record: Iobit Advanced System Care Service · CVSS 8.5 High · Not analysed yet · Published 16 May 2026 · Tags: CWE-428
- [Privacy Drive 3.17.0 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37231.md)
  `CVE-2020-37231` · CVE record: Cybertronsoft Privacy Drive · CVSS 8.5 High · Not analysed yet · Published 16 May 2026 · Tags: CWE-428
- [Syncplify.me Server! 5.0.37 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37230.md)
  `CVE-2020-37230` · CVE record: Syncplify Syncplify.me Server! · CVSS 8.5 High · Not analysed yet · Published 16 May 2026 · Tags: CWE-428
- [OKI sPSV Port Manager 1.0.41 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37229.md)
  `CVE-2020-37229` · CVE record: Oki OKI sPSV Port Manager · CVSS 8.5 High · Not analysed yet · Published 16 May 2026 · Tags: CWE-428
- [IObit Uninstaller 9.5.0.15 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2020-37223.md)
  `CVE-2020-37223` · CVE record: Iobit IObit Uninstaller · CVSS 8.5 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-428
- [Argus Surveillance DVR 4.0 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2021-47945.md)
  `CVE-2021-47945` · CVE record: argus Argus Surveillance DVR · CVSS 8.5 High · Not analysed yet · Published 10 May 2026 · Tags: CWE-428
- [eMPIA Technology｜AVACAST - Unquoted Service Path](https://agentprime.io/advisories/CVE-2026-7280.md)
  `CVE-2026-7280` · CVE record: eMPIA Technology AVACAST · CVSS 8.4 High · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-428
- [Search path without quotes in CivetWeb](https://agentprime.io/advisories/CVE-2026-5789.md)
  `CVE-2026-5789` · CVE record: CivetWeb CivetWeb · CVSS 8.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-428
- [sheed AntiVirus 2.3 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20061.md)
  `CVE-2016-20061` · CVE record: Sheedantivirus sheed AntiVirus · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-428
- [Hotspot Shield 6.0.3 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20060.md)
  `CVE-2016-20060` · CVE record: Hotspotshield Hotspot Shield · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-428
- [IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20059.md)
  `CVE-2016-20059` · CVE record: Iobit IObit Malware Fighter · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-428
- [Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20058.md)
  `CVE-2016-20058` · CVE record: Netgate NETGATE AMITI Antivirus · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-428
- [NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20057.md)
  `CVE-2016-20057` · CVE record: Netgate NETGATE Registry Cleaner · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-428
- [Spy Emergency build 23.0.205 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20056.md)
  `CVE-2016-20056` · CVE record: Spy-Emergency Spy Emergency · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-428
- [IObit Advanced SystemCare 10.0.2 Unquoted Service Path Privilege Escalation](https://agentprime.io/advisories/CVE-2016-20055.md)
  `CVE-2016-20055` · CVE record: Iobit IObit Advanced SystemCare · CVSS 8.5 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-428
- [Electron: Unquoted executable path in app.setLoginItemSettings on Windows](https://agentprime.io/advisories/GHSA-jfqx-fxh3-c62j.md)
  `GHSA-jfqx-fxh3-c62j`, `CVE-2026-34768` · npm `electron`: affected `<38.8.6 || >=39.0.0-alpha.1, <39.8.1 || >=40.0.0-alpha.1, <40.8.0 || >=41.0.0-alpha.1, <41.0.0-beta.8`, fixed in `38.8.6`, `39.8.1`, `40.8.0`, `41.0.0-beta.8` · CVSS 3.9 Low · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-428
- [Multiple vulnerabilities in Small HTTP server by Smallsrv](https://agentprime.io/advisories/CVE-2025-41359.md)
  `CVE-2025-41359` · CVE record: Smallsrv Small HTTP · CVSS 8.5 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-428
- [Unquoted search path in SANYO DENKI CO., LTD. SANUPS SOFTWARE STANDALONE and others](https://agentprime.io/advisories/CVE-2026-33253.md)
  `CVE-2026-33253` · CVE record: SANYO DENKI CO., LTD. SANUPS SOFTWARE STANDALONE and 1 more · CVSS 8.4 High · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-428
- [Serviio PRO 1.8 Local Privilege Escalation via Unquoted Path](https://agentprime.io/advisories/CVE-2017-20218.md)
  `CVE-2017-20218` · CVE record: Serviio Serviio PRO · CVSS 8.5 High · Not analysed yet · Published 15 Mar 2026 · Tags: CWE-428
- [MobaXterm < 26.1 Notepad++ Unquoted Service Path](https://agentprime.io/advisories/CVE-2026-25866.md)
  `CVE-2026-25866` · CVE record: Mobatek MobaXterm · CVSS 8.5 High · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-428
- [Unquoted search path in Dell Inc. UPS Multi-UPS Management Console (MUMC)](https://agentprime.io/advisories/CVE-2026-26033.md)
  `CVE-2026-26033` · CVE record: Dell Inc. UPS Multi-UPS Management Console (MUMC) · CVSS 8.4 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-428
- [OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (\`jq\`)](https://agentprime.io/advisories/GHSA-5gj7-jf77-q2q2.md)
  `GHSA-5gj7-jf77-q2q2`, `CVE-2026-32009` · npm `openclaw`: affected `<2026.2.24`, fixed in `2026.2.24` · CVSS 7.0 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-426, CWE-428, CWE-829
- [Unquoted search path in Canon Inc. IJ Scan Utility](https://agentprime.io/advisories/CVE-2026-1585.md)
  `CVE-2026-1585` · CVE record: Canon Inc. IJ Scan Utility · CVSS 8.4 High · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-428
- [Total VPN win-service.exe unquoted search path](https://agentprime.io/advisories/CVE-2026-2542.md)
  `CVE-2026-2542` · CVE record: Total VPN · CVSS 7.3 High · Not analysed yet · Published 16 Feb 2026 · Tags: CWE-426, CWE-428
- [RTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service Path](https://agentprime.io/advisories/CVE-2019-25345.md)
  `CVE-2019-25345` · CVE record: Realtek RTK IIS Codec Service · CVSS 8.5 High · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-428
- [ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path](https://agentprime.io/advisories/CVE-2019-25310.md)
  `CVE-2019-25310` · CVE record: Actfax ActiveFax Server · CVSS 8.5 High · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-428

Older: <https://agentprime.io/advisories/tag/cwe-428.md?cursor=WyIyMDI2LTAyLTExVDE0OjU2OjUyLjExODAwMFoiLCJDVkUtMjAxOS0yNTMxMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-428>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-428/>. Everything for agents: <https://agentprime.io/llms.txt>.