Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,282

Export CSV
CVE-2026-44358

Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint

Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior to 1.0.1, the action's entrypoint.sh invoked DangerJS from the caller's workspace after copying the fork's checkout into it, creating an untrusted search path for both binary resolution and Node.js module resolution. A fork pull request processed by a pull_request_target workflow could therefore cause fork-supplied code to execute inside the action container in place of the action's own code. This vulnerability is fixed in 1.0.1.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Espressif
Products
Shared-github-dangerjs
CVE-2026-47274

pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, multiple pam_usb helper tools resolved external binaries through the PATH environment variable rather than using absolute paths. An attacker who can influence the process environment during PAM authentication or tool execution could substitute malicious binaries. The affected tools are pamusb-check (src/tmux.c), pamusb-conf (tools/pamusb-conf), and pamusb-keyring-unlock-gnome (tools/pamusb-keyring-unlock-gnome). This vulnerability is fixed in 0.9.0.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mcdope
Products
Pam Usb
CVE-2023-52945

Uncontrolled Search Path Element in OpenSSL DLL Enables Arbitrary Local Code Execution on Synology BeeDrive Desktop

Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Beedrive Beedrive For Desktop
CVE-2022-28247

Adobe Acrobat Uninstaller Hard Link Leads To Remote Code Execution

Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an uncontrolled search path vulnerability that could lead to local privilege escalation. Exploitation of this issue requires user interaction in that a victim must run the uninstaller with Admin privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Acrobat Acrobat Dc Acrobat Reader and 3 more
CVE-2025-41670

Untrusted Search Path

A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users. As the service runs with elevated privileges, successful exploitation may result in a local privilege escalation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Phoenix Contact
Products
Axc F 1152 Axc F 1252 Axc F 2000 Ea and 11 more
CVE-2024-47091

Privilege escalation via mk_mysql agent plugin on Windows

Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' (or with write access to a binary referenced by such a service) to execute arbitrary code in the context of the Checkmk agent service, which typically runs as SYSTEM.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-32323

Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Mullvad
Products
Mullvad Vpn
CVE-2026-7373

Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Rapid7
Products
Metasploit
CVE-2026-32679

DLL Hijacking in LiveOn Meet and CanonNWCam Plugin Installers

The installers of LiveOn Meet Client for Windows (Downloader5Installer.exe and Downloader5InstallerForAdmin.exe) and the installers of Canon Network Camera Plugin (CanonNWCamPlugin.exe and CanonNWCamPluginForAdmin.exe) insecurely load Dynamic Link Libraries (DLLs). If a malicious DLL is placed at the same directory, the affected installer may load that DLL and execute its code with the privilege of the user invoking the installer.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Japan Media Systems Corporation Liveon
Products
Canonnwcamplugin.exe Canonnwcampluginforadmin.exe Downloader5installer.exe and 5 more
CVE-2024-36333

Privilege Escalation via DLL Hijacking in AMD Cleanup Utility

A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Amd
Products
Amd Cleanup Utility Cleanup Utility Radeon Pro Vii and 26 more
CVE-2026-40004

openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview

There exists an openssl.cnf privilege escalation vulnerability in ZTE Cloud PC client uSmartview. An attacker can execute arbitrary code locally and escalate privileges.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Zxcloud Irai
CVE-2025-69599

Privilege Escalation via PATH Variable Manipulation in RayVentory Scan Engine

RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. NOTE: this is disputed because ability of an attacker to control the environment is a site-specific misconfiguration.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Raynet
Products
Rayventory Scan Engine
CVE-2026-44612

Insecure DLL loading in Bytello Share Windows Installer enabling arbitrary code execution

Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Bytello
Products
Bytello Share (windows Edition) Installer Executable
CVE-2026-20772

Privilege Escalation via Uncontrolled Search Path in Intel Connectivity Performance Suite Installers

Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121.193 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Connectivity Performance Suite
CVE-2026-45004

OpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository and convincing a user to run OpenClaw commands from that directory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-44406

DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview

ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Zxcloud Irai
CVE-2026-4546

Flos Freeware Notepad2 TextShaping.dll uncontrolled search path

A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can lead to uncontrolled search path. The attack is restricted to local execution. The attack requires a high level of complexity. The exploitability is said to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Flos-freeware Flos Freeware
Products
Notepad2 Notepad2
CVE-2026-4545

Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path

A security flaw has been discovered in Flos Freeware Notepad2 4.2.25. This affects an unknown function in the library PROPSYS.dll. Performing a manipulation results in uncontrolled search path. The attack is only possible with local access. The attack is considered to have high complexity. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Flos-freeware Flos Freeware
Products
Notepad2 Notepad2
CVE-2026-25852

DLL Hijacking Exploitation Allows Local Privilege Escalation in Acronis DeviceLock DLP

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.

CVSS 3.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Acronis
Products
Acronis Devicelock Dlp