CWE-428

CWE-428 · 6 records · 0 with a public proof-of-concept

Records the NVD classes under CWE-428, highest CVSS first.

  1. HIGH 7.8CVE-2026-821552026-11-03

    Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 7.8CVE-2026-814692026-09-21

    Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 7.5CVE-2026-153582026-09-23

    ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 7.3CVE-2026-187552026-08-04

    A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe search directory to execute arbitrary code. By placing a crafted dynamic-link library (DLL) file into the application search path prior to the legiti…

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 6.7CVE-2026-978602026-10-29

    YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 6.7CVE-2026-668392026-08-05

    NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.

    AI risk analysis on Exploit-DB.ai →