Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 747

Export CSV
CVE-2026-40287

PraisonAI has RCE via Automatic tools.py Import

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_from_file()), tool_resolver.py (_load_local_tools()), and CLI tool-loading paths blindly import ./tools.py at startup without any validation, sandboxing, or user confirmation. An attacker who can place a malicious tools.py in the directory where PraisonAI is launched (such as through a shared project, cloned repository, or writable workspace) achieves immediate arbitrary Python code execution in the host environment. This compromises the full PraisonAI process, the host system, and any connected data or credentials. This issue has been fixed in version 4.5.139.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison Praison
Products
Praisonai Praisonaiagents Praisonai and 1 more
CVE-2025-40909

Perl threads have a working directory race condition where file operations may target unintended paths

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Perl
Products
Perl
CVE-2026-21280

Illustrator | Untrusted Search Path (CWE-426)

Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Illustrator Macos Windows
CVE-2026-23512

SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is trigger. The application executes notepad.exe without specifying an absolute path when using the Advanced Options setting. On Windows, this allows execution of a malicious notepad.exe placed in the application's installation directory, leading to arbitrary code execution.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Sumatrapdfreader
Products
Windows Sumatrapdf
CVE-2026-23888

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vectors: (1) Malicious ZIP entries containing `../` or absolute paths that escape the extraction root via AdmZip's `extractAllTo`, and (2) The `BinaryResolution.prefix` field is concatenated into the extraction path without validation, allowing a crafted prefix like `../../evil` to redirect extracted files outside `targetDir`. The issue impacts all pnpm users who install packages with binary assets, users who configure custom Node.js binary locations and CI/CD pipelines that auto-install binary dependencies. It can lead to overwriting config files, scripts, or other sensitive files leading to RCE. Version 10.28.1 contains a patch.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pnpm
Products
Pnpm
CVE-2026-0662

Untrusted Search Path Vulnerability when opening max Files

A maliciously crafted project directory, when opening a max file in Autodesk 3ds Max, could lead to execution of arbitrary code in the context of the current process due to an Untrusted Search Path being utilized.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
3ds Max
CVE-2026-25880

Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, the PDF reader allows execution of a malicious binary (explorer.exe) located in the same directory as the opened PDF when the user clicks File → “Show in folder”. This behavior leads to arbitrary code execution on the victim’s system with the privileges of the current user, without any warning or user interaction beyond the menu click.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Sumatrapdfreader
Products
Sumatrapdf
CVE-2026-2538

Flos Freeware Notepad2 Msimg32.dll uncontrolled search path

A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a requirement. The attack's complexity is rated as high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Flos Freeware
Products
Notepad2
CVE-2026-2542

Total VPN win-service.exe unquoted search path

A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Total Vpn
Products
Total Vpn
CVE-2026-25926

Notepad++ has an Untrusted Search Path

Notepad++ is a free and open-source source code editor. An Unsafe Search Path vulnerability (CWE-426) exists in versions prior to 8.9.2 when launching Windows Explorer without an absolute executable path. This may allow execution of a malicious explorer.exe if an attacker can control the process working directory. Under certain conditions, this could lead to arbitrary code execution in the context of the running application. Version 8.9.2 patches the issue.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Notepad-plus-plus
Products
Notepad++ Notepad\+\+
CVE-2026-40947

Unintended DLL Search Path in Yubico Authentication Libraries

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Yubico
Products
Libfido2 Python-fido2 Yubikey-manager
CVE-2026-29089

TimescaleDB uses untrusted search path during extension upgrade

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the search_path setting to locate unqualified database objects (tables, functions, operators). If the search_path includes user-writable schemas a malicious user can create functions in that schema that shadow builtin postgres functions and will be called instead of the postgres functions leading to arbitrary code execution during extension upgrade. This issue has been patched in version 2.25.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Timescale
Products
Timescaledb
CVE-2026-3787

UltraVNC Windows Service cryptbase.dll uncontrolled search path

A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Ultravnc Uvnc
Products
Windows Ultravnc Ultravnc
CVE-2026-21333

Illustrator | Untrusted Search Path (CWE-426)

Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Adobe Microsoft
Products
Illustrator Windows
CVE-2026-27290

Adobe Framemaker | Untrusted Search Path (CWE-426)

Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Adobe Microsoft
Products
Framemaker Windows
CVE-2026-2516

Unidocs ezPDF DRM Reader/ezPDF Reader SHFOLDER.dll uncontrolled search path

A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDER.dll. Such manipulation leads to uncontrolled search path. The attack needs to be performed locally. Attacks of this nature are highly complex. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading the affected component is recommended. The vendor explains: "[W]e have already addressed similar DLL search path vulnerability patterns through prior security updates. (...) Users are advised to use the latest version provided by the vendor."

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Unidocs
Products
Ezpdf Drm Reader Ezpdf Reader
CVE-2025-4769

CBEWIN Anytxt Searcher ATService.exe uncontrolled search path

A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-4971

Broadcom Automic Automation Agent Unix privilege escalation

Broadcom Automic Automation Agent Unix versions < 24.3.0 HF4 and < 21.0.13 HF1 allow low privileged users who have execution rights on the agent executable to escalate their privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—