Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems.
A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /products.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Search parameter.
CVE-2026-4546 is a high-severity vulnerability in Flos Freeware Notepad2 version 4.2.25 involving an uncontrolled search path in the TextShaping.dll library. This flaw allows a local attacker with limited privileges to manipulate the search path used by the application, potentially leading to the loading of malicious code. Exploitation is complex and requires local access, with no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability due to high impact on these security properties. No patches or vendor responses are currently available, and no known exploits exist in the wild. Organizations using this specific version of Notepad2 should prioritize mitigation to prevent local privilege escalation or code execution risks.
SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlying SQLite database without any authorization or read-only checks. This allows any authenticated user — including those with the Reader role — to execute arbitrary SQL statements (SELECT, DELETE, UPDATE, DROP TABLE, etc.) against the application's database. This is inconsistent with the application's own security model: the dedicated SQL endpoint (/api/query/sql) correctly requires both CheckAdminRole and CheckReadonly middleware, but the search endpoint bypasses these controls entirely. This issue has been fixed in version 3.6.1.
A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driver to modify the DLL injection path used by the product. By redirecting this path to a user-writable location, an attacker can cause OpenEDR to load an attacker-controlled DLL into high-privilege processes. This results in arbitrary code execution with SYSTEM privileges, leading to full compromise of the affected system.
IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolled search path element vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system.
SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's context provided GuiXT is enabled. This vulnerability has a low impact on confidentiality, integrity, and availability.
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.
This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose.
This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.
SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed.
This issue was fixed in 6.30@A04.4_u06.
SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing attacker-supplied JavaScript to execute in the administrator's browser. This can enable session theft, administrative action forgery, or other browser-based compromise in the context of an admin user.
The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges.
A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-25656 is a high-severity vulnerability in Siemens SINEC NMS and its User Management Component (UMC) affecting versions prior to V4.0 SP3 and V2.15.2.1 respectively. It allows a low-privileged user to improperly modify a configuration file, which can lead to loading malicious DLLs. Successful exploitation could result in arbitrary code execution with SYSTEM privileges. The vulnerability is classified under CWE-427 (Uncontrolled Search Path Element). No patch or official remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-25880 is a high-severity vulnerability in SumatraPDF versions 3.5.2 and earlier, involving an untrusted search path weakness (CWE-426). When a user opens a PDF and clicks File → “Show in folder”, the application executes a binary named explorer.exe located in the same directory as the PDF without proper validation. This allows an attacker to place a malicious executable in the PDF’s folder, leading to arbitrary code execution with the current user's privileges. Exploitation requires user interaction limited to clicking the menu option, with no additional warnings. The vulnerability affects Windows systems running vulnerable SumatraPDF versions. Although no known exploits are reported in the wild yet, the ease of exploitation and high impact on confidentiality, integrity, and availability make this a significant threat. European organizations using SumatraPDF on Windows should prioritize patching or mitigating this issue to prevent potential compromise.
CVE-2026-24466 is a vulnerability affecting Oki Electric Industry Co. , Ltd.products and their OEM versions, including those from Ricoh and Murata Machinery. The issue arises from unquoted service paths in Windows services, allowing users with write permissions on the system drive root directory to execute arbitrary code with SYSTEM privileges. This vulnerability requires local access with elevated privileges and does not need user interaction. Exploitation could lead to full system compromise, impacting confidentiality, integrity, and availability. The CVSS score is 6.7, indicating a medium severity level. No known exploits are currently reported in the wild. European organizations using affected products should prioritize patching and restrict write permissions on critical directories.
CVE-2026-24694 is a high-severity vulnerability in Roland Corporation's Roland Cloud Manager version 3.1.19 and earlier. The installer insecurely loads DLLs, allowing attackers to execute arbitrary code with the application's privileges. Exploitation requires local access and user interaction but no prior authentication. This uncontrolled search path element flaw can compromise confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild. European organizations using Roland Cloud Manager, particularly in music production and audio industries, should prioritize patching or mitigating this risk. The vulnerability's high CVSS score (7.8) reflects its significant impact potential.
CVE-2026-24051 is a high-severity vulnerability affecting the OpenTelemetry-Go SDK versions 1.21.0 up to but not including 1.40.0 on macOS/Darwin systems. The vulnerability arises from an untrusted search path (CWE-426) in the resource detection code that executes the 'ioreg' system command without specifying an absolute path. An attacker with local access who can modify the PATH environment variable can hijack this command execution to run arbitrary code within the application's context. This flaw allows for arbitrary code execution without user interaction but requires local privileges and a high attack complexity. No known exploits are currently reported in the wild. The issue was fixed in version 1.
During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC service of the privileged helper is only allowed if the client process is signed with the corresponding certificate and fulfills the following code signing requirement:
"anchor trusted and certificate leaf[subject.CN] = \"Developer ID Application: Native Instruments GmbH (83K5EG6Z9V)\""
The Native Access application was found to be signed with the `com.apple.security.cs.allow-dyld-environment-variables` and `com.apple.security.cs.disable-library-validation` entitlements leading to DYLIB injection and therefore command execution in the context of this application. A low privileged user can exploit the DYLIB injection to trigger functions of the privileged helper XPC service resulting in privilege escalation by first deleting the /etc/sudoers file and then copying a malicious version of that file to /etc/sudoers.
PsySH is a runtime developer console, interactive debugger, and REPL for PHP. Prior to versions 0.11.23 and 0.12.19, PsySH automatically loads and executes a `.psysh.php` file from the Current Working Directory (CWD) on startup. If an attacker can write to a directory that a victim later uses as their CWD when launching PsySH, the attacker can trigger arbitrary code execution in the victim's context. When the victim runs PsySH with elevated privileges (e.g., root), this results in local privilege escalation. This is a CWD configuration poisoning issue leading to arbitrary code execution in the victim user’s context. If a privileged user (e.g., root, a CI runner, or an ops/debug account) launches PsySH with CWD set to an attacker-writable directory containing a malicious `.psysh.php`, the attacker can execute commands with that privileged user’s permissions, resulting in local privilege escalation. Downstream consumers that embed PsySH inherit this risk. For example, Laravel Tinker (`php artisan tinker`) uses PsySH. If a privileged user runs Tinker while their shell is in an attacker-writable directory, the `.psysh.php` auto-load behavior can be abused in the same way to execute attacker-controlled code under the victim’s privileges. Versions 0.11.23 and 0.12.19 patch the issue.