CVE-2026-20772

Privilege Escalation via Uncontrolled Search Path in Intel Connectivity Performance Suite Installers

Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121.193 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Connectivity Performance Suite

CVE-2022-4987

Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution

Hirschmann Industrial HiVision version 08.1.03 prior to 08.1.04 and 08.2.00 contains a vulnerability in the execution of user-configured external applications that allows a local attacker to execute arbitrary binaries. Due to insufficient path sanitization, an attacker can place a malicious binary in the execution path of a configured external application, causing it to be executed instead of the intended application. This can result in execution with elevated privileges depending on the context of the external application.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hirschmann Industrial Hivision

CVE-2026-45004

OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository and convincing a user to run OpenClaw commands from that directory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-44406

DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview

ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Zxcloud Irai

CVE-2026-7990

chromium-browser: Insufficient validation of untrusted input in Updater

Insufficient validation of untrusted input in Updater in Google Chrome on Windows prior to 148.0.7778.96 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2026-7309

Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2026-42519

Jenkins Script Security Plugin: Jenkins Script Security Plugin: Information disclosure via missing permission check

A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Jenkins Project

Products

Script Security Jenkins Script Security Plugin

CVE-2026-25866

MobaXterm < 26.1 Notepad++ Unquoted Service Path

MobaXterm versions prior to 26.1 contain an uncontrolled search path element vulnerability. The application calls WinExec to execute Notepad++ without a fully qualified executable path when opening remote files. An attacker can exploit the search path behavior by placing a malicious executable earlier in the search order, resulting in arbitrary code execution in the context of the affected user.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Mobatek

Products

Mobaxterm

CVE-2026-43505

Unauthorized traffic relay via misconfigured mod_proxy65

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Prosody

Products

Prosody

CVE-2026-4546

Flos Freeware Notepad2 TextShaping.dll uncontrolled search path

A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can lead to uncontrolled search path. The attack is restricted to local execution. The attack requires a high level of complexity. The exploitability is said to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Flos-freeware Flos Freeware

Products

Notepad2 Notepad2

CVE-2026-4545

Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path

A security flaw has been discovered in Flos Freeware Notepad2 4.2.25. This affects an unknown function in the library PROPSYS.dll. Performing a manipulation results in uncontrolled search path. The attack is only possible with local access. The attack is considered to have high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Flos-freeware Flos Freeware

Products

Notepad2 Notepad2

CVE-2026-25852

DLL Hijacking Exploitation Allows Local Privilege Escalation in Acronis DeviceLock DLP

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Acronis

Products

Acronis Devicelock Dlp

CVE-2026-4962

UltraVNC Service version.dll uncontrolled search path

A security flaw has been discovered in UltraVNC up to 1.6.4.0. Affected by this issue is some unknown functionality in the library version.dll of the component Service. The manipulation results in uncontrolled search path. The attack needs to be approached locally. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ultravnc Uvnc

Products

Ultravnc Ultravnc

CVE-2026-35029

LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetching via /get_image, and take over other privileged accounts by overwriting UI_USERNAME and UI_PASSWORD environment variables. Fixed in v1.83.0.

CVSS 4.0 · 8.7 High EPSS 38.6% KEV · Not listed

Vendors

Berriai Litellm

Products

Litellm Litellm

CVE-2025-10549

DLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Efficientlab

Products

Controlio

CVE-2026-32172

Microsoft Power Apps Remote Code Execution Vulnerability

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Power-apps Power Apps

CVE-2026-7279

eMPIA Technology｜AVACAST - DLL Hijacking

AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directory, resulting in arbitrary code execution with system privileges when the system loads the DLL.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Empia Technology

Products

Avacast

CVE-2026-7280

eMPIA Technology｜AVACAST - Unquoted Service Path

AVACAST developed by eMPIA Technology has a Unquoted Service Path vulnerability, allowing privileged local attackers to place a malicious executable file in a specific directory, resulting in arbitrary code execution with system privileges when the AVACAST service starts.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Empia Technology

Products

Avacast

CVE-2026-24070

Local Privilege Escalation via DYLIB Injection in Native Instruments Native Access

During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC service of the privileged helper is only allowed if the client process is signed with the corresponding certificate and fulfills the following code signing requirement: "anchor trusted and certificate leaf[subject.CN] = \"Developer ID Application: Native Instruments GmbH (83K5EG6Z9V)\"" The Native Access application was found to be signed with the `com.apple.security.cs.allow-dyld-environment-variables` and `com.apple.security.cs.disable-library-validation` entitlements leading to DYLIB injection and therefore command execution in the context of this application. A low privileged user can exploit the DYLIB injection to trigger functions of the privileged helper XPC service resulting in privilege escalation by first deleting the /etc/sudoers file and then copying a malicious version of that file to /etc/sudoers.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Native-instruments Native Instruments

Products

Macos Native Access Native Access

CVE-2026-34488

DLL Search Path Vulnerability in i‑PRO IP Setting Software Allows Arbitrary Code Execution with Administrative Privileges

IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

I-pro

Products

Ip Setting Software