draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE directory, which ordinary users can upload files to. A user could therefore upload an executable to shared storage, point their binary path at it, and have pgAdmin run it as the operating-system account running pgAdmin. On POSIX, files created through pgAdmin are not executable, so this is exploitable where any file with an executable name can run, such as Windows server mode.
The fix checks the binary path against every SHARED_STORAGE directory as well, after expanding $DIR, collapsing ".." and resolving symbolic links, compares directories in a way a different spelling on a case-insensitive filesystem cannot bypass, refuses a path containing a NUL, and enforces the check wherever binary paths are resolved, including for the PSQL tool.
This issue affects pgAdmin 4: before 9.19.
CVE-2026-57203 is a vulnerability in Asterisk's ast_loggrabber component where it executes a Python script from the world-writable /tmp directory. This allows an attacker with shell access to place a malicious script that could be executed with elevated privileges when an administrator runs ast_loggrabber. The issue affects multiple versions of Asterisk prior to fixed releases and has been addressed in versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and certain Certified Asterisk releases.
CVE-2026-105477 is a local privilege escalation vulnerability in Veeam Agent for Linux versions 13.1 up to but not including 13.1.2. It affects only installations managed by a Veeam Backup & Replication instance. The flaw is due to an untrusted search path (CWE-426) that could allow an attacker with local access to escalate privileges.
CVE-2026-113461 is a local privilege escalation vulnerability in Checkmk version 2.5.0p14. It affects systems where a local user has write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself. If the Checkmk agent has the 'mk-oracle' plugin enabled, an attacker can execute code with root privileges.
CVE-2026-0315 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app for macOS. It allows a local non-administrative user to escalate privileges to root by exploiting an untrusted search path issue. Other platforms such as Linux, Windows, iOS, Android, and Chrome OS are not affected. The vulnerability has a medium severity rating with a CVSS score of 5.9.
Adobe Dimension versions up to 4.1.8 are affected by an Untrusted Search Path vulnerability (CWE-426) that could allow a local attacker with user permissions to execute arbitrary code. Exploitation requires user interaction, specifically running the vulnerable application. The vulnerability impacts confidentiality, integrity, and availability, and changes the security scope.
CVE-2026-83509 is a vulnerability in Microsoft Windows 10 Version 1607 and related versions involving an untrusted search path in Windows Setup Files Cleanup. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-83506 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds involving an untrusted search path in Servicing Stack Updates. This flaw allows an authorized local attacker to elevate privileges by exploiting the way the system searches for files during servicing stack operations. The vulnerability affects multiple Windows 10 versions prior to their respective fixed releases.
CVE-2026-83505 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in the Windows Setup Files Cleanup component of Microsoft Windows 10 Version 1607 and later updates. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity rating with a CVSS score of 7. Microsoft has released official fixes for affected versions.
CVE-2026-69733 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving an untrusted search path in Windows Update. This flaw allows an authorized local attacker to elevate privileges by exploiting the way Windows Update searches for files. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-69882 is an untrusted search path vulnerability in Windows Update on Microsoft Windows 11 version 23H2. It allows an authorized local attacker to elevate privileges by exploiting the way Windows Update searches for files. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official fixes for this issue.
CVE-2026-70142 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving an untrusted search path in the Windows Update Service. This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 11 23H2 prior to specific fixed versions. A patch is officially available from Microsoft to address this issue.
CVE-2026-108398 is an untrusted search path vulnerability in Microsoft .NET Framework versions 3.5 and 4.6.2 through 4.7.2. This flaw allows an authorized local attacker to bypass security features by exploiting the way the framework searches for resources. The issue affects specific versions prior to fixed releases 4.7.4150.0, 4.8.4811.0, and 4.8.9363.0. Microsoft has issued official fixes for this vulnerability.
A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers also might load from an unsecured location, potentially leading to privilege escalation.
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable.
CVE-2026-105331 is a local privilege escalation vulnerability in Checkmk versions 2.5.0 up to but not including 2.5.0p10. It arises from an untrusted search path issue in the 'mk-oracle' agent plugin that references the Oracle Instant Client. A user with access to modify the Oracle Instant Client used by this plugin can escalate privileges if the plugin is enabled on the agent.
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
CVE-2026-59265 is a high-severity code execution vulnerability in Apache OpenOffice up to version 4.1.16. It arises from an untrusted search path issue in the Java integration, allowing a crafted document to execute arbitrary code when opened. The issue is fixed in version 4.1.17, currently in release candidate phase. Users can mitigate the risk by disabling Java runtime integration or avoiding opening untrusted files until the update is applied.
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges.
This issue was fixed in version 10.08.0.