CWE-426: CWE-426
Yearly Trend
Top Affected Vendors
All CWE-426 CVEs (124)
This CVE describes an Untrusted Search Path vulnerability in NCP VPN clients that allows attackers to execute arbitrary code by placing malicious DLLs...
Nov 26, 2025This vulnerability in pnpm package manager allows malicious npm packages to bypass security controls and execute arbitrary code during installation. I...
Dec 10, 2024This vulnerability in iRODS before version 4.3.2 involves the msiSendMail function's insecure dependency on the mail binary, allowing command injectio...
Jun 16, 2024SoftExpert Excellence Suite 2.x versions before 2.1.3 contain a Local File Inclusion vulnerability in the defaultframe_filter.php component. This allo...
May 12, 2023This vulnerability allows arbitrary code execution on Windows systems when Git LFS processes malicious repositories. Attackers can trick Git LFS into ...
Apr 20, 2022CVE-2022-26184 is an untrusted search path vulnerability in Poetry package manager versions 1.1.9 and below on Windows. This allows attackers to execu...
Mar 21, 2022This vulnerability allows an unauthenticated attacker on the same network to escalate privileges on Windows systems running vulnerable Zoom clients. A...
Aug 12, 2025The passprompt plugin in pppd (Point-to-Point Protocol daemon) before version 2.5.2 mishandles privileges, potentially allowing local privilege escala...
Apr 22, 2025This is a privilege escalation vulnerability in the aiven-extras PostgreSQL extension that allows attackers to gain superuser privileges within Postgr...
Apr 4, 2025CVE-2025-23266 is a container escape vulnerability in NVIDIA Container Toolkit that allows attackers to execute arbitrary code with elevated permissio...
Jul 17, 2025This vulnerability allows local privilege escalation on macOS systems running Native Access. A low-privileged user can exploit DYLIB injection in the ...
Feb 2, 2026This vulnerability allows a local authenticated attacker to perform DLL hijacking in Ivanti Workspace Control's management console, enabling privilege...
Sep 10, 2024This vulnerability allows local attackers to escalate privileges on Windows systems running vulnerable versions of Cato Networks SDP Client. Attackers...
Jul 31, 2024CVE-2024-32019 is a local privilege escalation vulnerability in Netdata's ndsudo tool that allows attackers to execute arbitrary programs with root pe...
Apr 12, 2024CVE-2024-26198 is a remote code execution vulnerability in Microsoft Exchange Server that allows attackers to execute arbitrary code on affected syste...
Mar 12, 2024CVE-2022-4883 is a path injection vulnerability in libXpm where the library calls external compression programs (like gzip) using the PATH environment...
Feb 7, 2023This vulnerability in Viscosity VPN client allows attackers to execute arbitrary code by exploiting an untrusted search path issue in the DLL handler....
Jun 30, 2022CVE-2021-41387 is a privilege escalation vulnerability in seatd-launch component of seatd (a seat management daemon for Wayland compositors). It allow...
Sep 17, 2021SumatraPDF versions 3.5.2 and earlier contain an untrusted search path vulnerability that allows arbitrary code execution. When users trigger the Adva...
Jan 14, 2026This CVE describes an untrusted search path vulnerability in Adobe Illustrator that could allow arbitrary code execution when a user opens a malicious...
Jan 13, 2026This CVE describes an Untrusted Search Path vulnerability in Adobe Creative Cloud versions 5.9.1 and earlier. Attackers can manipulate the application...
Mar 22, 2023CVE-2023-23618 is a path traversal vulnerability in Git for Windows where the gitk tool can inadvertently execute malicious executables from the curre...
Feb 14, 2023This vulnerability allows attackers to execute arbitrary code on HI-SCAN 6040i Hitrax HX-03-19-I devices by uploading a malicious script via USB autor...
Jan 15, 2025The WiX toolset vulnerability allows attackers to perform DLL redirection attacks via the .be TEMP folder, enabling privilege escalation. This affects...
Feb 7, 2024CVE-2022-31012 is a vulnerability in Git for Windows where the installer mistakenly executes a binary from C:\mingw64\bin\git.exe during fresh install...
Jul 12, 2022This vulnerability in HP One Agent allows local attackers to escalate privileges on affected HP PC systems. Attackers could gain higher-level system a...
Oct 2, 2024This CVE describes an untrusted search path vulnerability in Microsoft Dataverse that allows authenticated attackers to execute arbitrary code over a ...
Jun 27, 2024This CVE describes a DLL hijacking vulnerability in eAI Technologies ERP software where authenticated local attackers can place malicious DLL files in...
Feb 23, 2026SumatraPDF versions 3.5.2 and earlier contain a vulnerability where clicking 'Show in folder' in the File menu executes explorer.exe from the same dir...
Feb 9, 2026This vulnerability allows attackers to execute arbitrary code by tricking users into opening malicious project directories in Autodesk 3ds Max. The at...
Feb 4, 2026This vulnerability allows a local attacker to execute arbitrary code by tricking AsusSoftwareManagerAgent into loading a malicious DLL from a controll...
Jan 6, 2026This CVE describes an authenticated local privilege escalation vulnerability in FreePBX's deprecated amportal startup script. Attackers who are member...
Dec 16, 2025This CVE describes an untrusted search path vulnerability in Adobe Acrobat Reader that allows attackers to execute arbitrary code without user interac...
Dec 9, 2025This vulnerability in Windows Administrator Protection allows an authenticated attacker to exploit an untrusted search path to elevate privileges loca...
Nov 11, 2025This vulnerability allows arbitrary code execution when Autodesk applications load malicious binary files from untrusted locations. Attackers can expl...
Jul 24, 2025Yandex Telemost for Desktop versions before 2.7.0 are vulnerable to DLL hijacking due to an untrusted search path. Attackers can place malicious DLLs ...
Jun 2, 2025An untrusted search path vulnerability in Lenovo PC Manager allows local attackers to execute arbitrary code with elevated privileges by placing malic...
May 30, 2025This vulnerability in GNU C Library (glibc) versions 2.27 to 2.38 allows attackers to load malicious shared libraries via the LD_LIBRARY_PATH environm...
May 16, 2025CVE-2025-27743 is an untrusted search path vulnerability in Microsoft System Center that allows an authorized attacker to execute arbitrary code with ...
Apr 8, 2025This vulnerability allows attackers with write access to a directory in the Windows %PATH% environment variable to escalate privileges when the Snowfl...
Jan 29, 2025CVE-2025-0707 is a critical untrusted search path vulnerability in Rise Group Rise Mode Temp CPU 2.1 that allows local attackers to execute arbitrary ...
Jan 24, 2025CVE-2025-21365 is a remote code execution vulnerability in Microsoft Office that allows attackers to execute arbitrary code on a victim's system by tr...
Jan 14, 2025This DLL hijacking vulnerability in Autodesk Revit allows attackers to execute arbitrary code by placing a malicious DLL in the same directory as an R...
Dec 9, 2024CVE-2024-49515 is an untrusted search path vulnerability in Substance3D Painter that could allow attackers to execute arbitrary code by manipulating t...
Nov 12, 2024This vulnerability in VRED Design allows privilege escalation to SYSTEM level when a malicious binary file is downloaded and executed. Attackers can e...
Nov 5, 2024This vulnerability in Microsoft Office allows attackers to execute arbitrary code on a victim's system by tricking them into opening a specially craft...
Oct 8, 2024This critical vulnerability in Intelbras InControl allows local attackers to execute arbitrary code through an unquoted search path in the watchdog se...
Sep 29, 2024This critical vulnerability in Intelbras InControl allows local attackers to execute arbitrary code through an unquoted search path in the incontrolWe...
Jun 17, 2024This vulnerability in Microsoft SharePoint Server allows authenticated attackers to execute arbitrary code remotely by uploading specially crafted fil...
Jun 11, 2024This vulnerability allows a local low-privileged attacker to exploit an untrusted search path in a CHARX system utility to escalate privileges to root...
May 14, 2024About CWE-426 (CWE-426)
Our database tracks 124 CVEs classified as CWE-426, with 10 rated critical and 103 rated high severity. The average CVSS score for CWE-426 vulnerabilities is 7.6.
External reference: View CWE-426 on MITRE CWE →
Monitor CWE-426 Vulnerabilities
Get alerted when new CWE-426 CVEs affect your infrastructure.
Start Monitoring Free