GALENO SISTEMI MAGISTRA version 3.12 has a vulnerability where the software downloads upgrade files without performing integrity checks. This flaw allows the installation of tampered updates, potentially compromising the system.
CVE-2026-118450 is a medium severity vulnerability in CompuGroup Medical's Venere product version 8.33.2. The software is installed outside the Program Files directory and loads or registers unsigned components from locations where unprivileged users can create files. This uncontrolled search path element issue (CWE-427) can lead to the loading of malicious components.
The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Anthropic's Claude Desktop application for Windows versions prior to 1.8089.0 contains an uncontrolled search path element vulnerability. The application invokes git.exe without specifying an absolute path, allowing an attacker to place a malicious git.exe in the current working directory of a project. This can lead to execution of the malicious executable with the user's privileges when opening an attacker-controlled or shared repository. The vulnerability is fixed in version 1.8089.0.
SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and 2026.1.19, Metalama.Framework and Metalama.Tool load and execute compile-time assemblies, auxiliary executable tools and embedded helper assemblies from predictable temporary directories. On `Linux` and `macOS`, the default `Path.GetTempPath()` location is world-writable, and existing artifacts are trusted based on sentinel or `.completed` marker files rather than integrity verification. A local unprivileged user on a shared machine or CI/build agent can pre-create the deterministic directory structure and plant a malicious DLL with the matching sentinel. When a higher-privileged developer or build account subsequently builds, Metalama skips regeneration and executes the planted artifact in the compiler, IDE or MSBuild process as the building user. This permits cross-user privilege escalation, reading source and secrets, supply-chain tampering with build output, or disrupting builds. Default Windows per-user temporary directories are protected by ACLs and are not affected. Deployer-selected insecure cache locations are outside the vulnerability's scope. This issue is fixed in versions 2025.1.18, 2026.0.25 and 2026.1.19.
pgAdmin 4 versions before 9.19 contain an untrusted search path vulnerability (CWE-426) that allows a user to execute arbitrary code by setting the binary path to an executable uploaded in a shared storage directory. This occurs because the application only validated binary paths against the per-user storage directory but not shared storage directories, enabling exploitation especially on Windows server mode where executable files can run from shared storage. The issue is fixed in version 9.19 by enhancing path validation and resolving symbolic links and directory spellings to prevent bypass.
GnuPG version 2.5.21 for Windows has a critical vulnerability due to incorrect permission assignment on the C:\ProgramData directory. This allows low-privilege users to create arbitrary subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
Adobe Creative Cloud Desktop Application versions up to 6.10.0.252.41 are affected by an Uncontrolled Search Path Element vulnerability (CWE-427). This flaw could allow a low-privileged attacker to execute arbitrary code in the context of the current user if the victim opens a malicious file. The vulnerability requires user interaction for exploitation. It has a high severity with a CVSS score of 7.3.
CVE-2026-91093 is a high-severity vulnerability in HP One Agent Software affecting certain HP PC products. It involves an uncontrolled search path element (CWE-427) that could allow escalation of privilege or arbitrary code execution. HP has released software updates to address this issue.
CVE-2026-92202 is a high-severity vulnerability in Luxion KeyShot version 2026.1.0 involving uncontrolled search path elements during BIP file parsing. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. The vulnerability arises from loading a library from an unsecured location, enabling code execution in the context of the current process.
CVE-2026-102438 is an uncontrolled search path element vulnerability in ASUS Armoury Crate versions 2.1.17 through 2.2.17. This flaw allows local users to execute arbitrary code with SYSTEM privileges by replacing a dynamic-link library (DLL) that a high-privilege process later loads. The vulnerability has a high severity with a CVSS score of 8.5. No public exploits or known active exploitation have been reported. No patch or official fix information is provided in the available data.
Dell Application Store versions prior to 26.05.0.7 contain an Uncontrolled Search Path Element vulnerability (CWE-427). This flaw allows a low privileged local attacker to potentially elevate privileges and execute arbitrary code. The vulnerability is addressed in version 26.05.0.7.
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Adobe Dimension contains an Uncontrolled Search Path Element vulnerability (CWE-427) that allows a local attacker with user permissions to execute arbitrary code by tricking a user into running the application. The vulnerability affects versions from 0 up to and including 4.1.8. Exploitation requires user interaction and changes the security scope. The CVSS 3.1 score is 8.6, indicating a high severity risk.
CVE-2026-69923 is a vulnerability in Microsoft Windows 11 Version 24H2 involving an uncontrolled search path element in Windows AI. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity score of 7.8 and affects multiple builds of Windows 11 24H2 prior to specific fixed versions. Microsoft has released official fixes for this issue.
ImageMagick on Windows versions up to 7.1.2-33 and 6.9.13-58 has an uncontrolled search path vulnerability in the NTGhostscriptEXE() function. This function launches the Ghostscript executable gswin64c.exe by its bare name when Ghostscript is unregistered. An attacker can exploit this by placing a malicious gswin64c.exe in the working directory, leading to code execution with ImageMagick privileges during conversion of PDF, PostScript, or EPS files.
An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs).
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
CVE-2026-47570 is a high-severity vulnerability in the NVIDIA GPU Display Driver for Windows, specifically in the CUDA driver. It involves an uncontrolled search path element that could allow an attacker to load a malicious library. Exploitation may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.