CWE-426
CWE-426 · 26 records · 9 with a public proof-of-concept
Records the NVD classes under CWE-426, highest CVSS first.
- CRITICAL 10CVE-2026-95182public PoC
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
- HIGH 8.8CVE-2026-108398
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
- HIGH 8.8CVE-2026-59265public PoC
A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user. This issue is expected to be fixed in version 4.1.17, whic…
- HIGH 8.6CVE-2026-103847
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions cou…
- HIGH 7.8CVE-2026-119333public PoC
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Expl…
- HIGH 7.8CVE-2026-83506
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-70142
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-69882
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
windows 11 23h2 · windows 11 24h2 · windows 11 25h2 · windows 11 26h1 · windows 11 26h2 · windows server 2025
- HIGH 7.8CVE-2026-69733
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
- HIGH 7.8CVE-2026-75782
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
- HIGH 7.7CVE-2026-106505public PoC
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a re…
backstage plugin-techdocs-node · backstage
- HIGH 7.5CVE-2026-116243public PoC
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE directory,…
pgadmin 4
- HIGH 7CVE-2026-83509
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-83505
Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
- HIGH 7CVE-2026-100310public PoC
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a mal…
- MEDIUM 6.7CVE-2026-100584public PoC
OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named execut…
- UNSCOREDCVE-2026-57203public PoC
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. …
- UNSCOREDCVE-2026-105477
A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.
- UNSCOREDCVE-2026-113461
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plu…
- UNSCOREDCVE-2026-0315
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. Th…
- UNSCOREDCVE-2026-4869
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisites…
- UNSCOREDCVE-2026-105331
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
- UNSCOREDCVE-2026-104809
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying t…
- UNSCOREDCVE-2026-19547
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installat…
- UNSCOREDCVE-2026-87723public PoC
In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute a…
- UNSCOREDCVE-2026-68492
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.