Total
712 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-0299 | 1 Paloaltonetworks | 1 Globalprotect | 2026-10-23 | N/A | 7.8 HIGH |
| Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, and Chrome OS is not affected. | |||||
| CVE-2026-113461 | 2026-10-23 | N/A | N/A | ||
| Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled. | |||||
| CVE-2025-11940 | 2026-10-19 | 6.0 MEDIUM | 7.0 HIGH | ||
| A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are highly complex. The exploitability is reported as difficult. Upgrading to version 144.0-1 mitigates this issue. The name of the patch is dd10e31dd873e9cb309fad8aed921d45bf905a55. It is suggested to upgrade the affected component. | |||||
| CVE-2026-69882 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-10-19 | N/A | 7.8 HIGH |
| Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-12286 | 2026-10-19 | 6.0 MEDIUM | 7.0 HIGH | ||
| A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-24051 | 2 Apple, Opentelemetry | 2 Macos, Opentelemetry | 2026-10-19 | N/A | 7.0 HIGH |
| OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0. | |||||
| CVE-2025-60718 | 1 Microsoft | 2 Windows 11 24h2, Windows 11 25h2 | 2026-10-18 | N/A | 7.8 HIGH |
| Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2025-13433 | 2026-10-18 | 6.0 MEDIUM | 7.0 HIGH | ||
| A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe of the component Windows Service. The manipulation results in unquoted search path. The attack is only possible with local access. A high complexity level is associated with this attack. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-12819 | 1 Pgbouncer | 1 Pgbouncer | 2026-10-18 | N/A | 7.5 HIGH |
| Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage. | |||||
| CVE-2026-95182 | 2026-10-16 | N/A | 10.0 CRITICAL | ||
| An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content. | |||||
| CVE-2026-4869 | 2026-10-16 | N/A | N/A | ||
| A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers also might load from an unsecured location, potentially leading to privilege escalation. | |||||
| CVE-2026-0315 | 2026-10-16 | N/A | N/A | ||
| A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability. | |||||
| CVE-2022-26488 | 3 Microsoft, Netapp, Python | 4 Windows, Active Iq Unified Manager, Ontap Select Deploy Administration Utility and 1 more | 2026-10-14 | 4.4 MEDIUM | 7.0 HIGH |
| In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2. | |||||
| CVE-2026-103847 | 2026-10-14 | N/A | 8.6 HIGH | ||
| Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed. | |||||
| CVE-2020-15801 | 3 Microsoft, Netapp, Python | 3 Windows, Max Data, Python | 2026-10-14 | 7.5 HIGH | 9.8 CRITICAL |
| In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected. | |||||
| CVE-2026-108398 | 2026-10-13 | N/A | 8.8 HIGH | ||
| Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. | |||||
| CVE-2020-9290 | 1 Fortinet | 2 Forticlient, Forticlient Virtual Private Network | 2026-10-13 | 6.9 MEDIUM | 7.3 HIGH |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | |||||
| CVE-2020-9287 | 1 Fortinet | 1 Forticlient Emergency Management Server | 2026-10-13 | 6.9 MEDIUM | 7.7 HIGH |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | |||||
| CVE-2019-5589 | 1 Fortinet | 1 Forticlient | 2026-10-13 | 9.3 HIGH | 8.8 HIGH |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | |||||
| CVE-2026-75782 | 2026-10-13 | N/A | 7.8 HIGH | ||
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable. | |||||