CVE-2021-22037

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path...

CVE-2021-22921

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PAT...

CVE-2025-40763

A vulnerability has been identified in Altair Grid Engine All versions V2026.0.0. Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary...

CVE-2025-14596

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1...

EUVD-2025-206250

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows Nios II Command Shell modules, Altera Quartus Prime Lite on Windows Nios II Command Shell modules allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 19.1 through 24.1; Quartus Pri...

CVE-2025-14599

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1...

Altera Quartus Prime Pro security vulnerability

Altera Quartus Prime Pro is an FPGA design software from Altera Corporation, USA. A security vulnerability exists in Altera Quartus Prime Pro versions 24.1 through 24.3.1, which originates from the presence of an uncontrolled search path element in the Windows installer, which could lead to searc...

CVE-2025-14599 Quartus® Prime Standard and Quartus® Prime Lite Security Advisory

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1...

CVE-2025-14605

CVE-2025-14605 affects Altera Quartus Prime Pro on Windows, specifically System Console modules, with versions 17.0 through 25.1.1 vulnerable to an Uncontrolled Search Path Element, enabling a Search Order Hijacking scenario. The root cause is the presence of an uncontrolled search path element t...

CVE-2025-14596 Quartus Prime Pro Edition Installer Advisory

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1...

CVE-2025-14596 Quartus Prime Pro Edition Installer Advisory

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1...

PT-2026-1516

Name of the Vulnerable Software and Affected Versions Altera Quartus Prime Standard versions 23.1 through 24.1 Altera Quartus Prime Lite versions 23.1 through 24.1 Description An uncontrolled search path element issue exists in the Altera Quartus Prime Standard Installer SFX and Altera Quartus...

Altera High Level Synthesis Compiler security vulnerabilities

Altera High Level Synthesis Compiler is a high-level synthesis tool from Altera Corporation, USA. A security vulnerability exists in Altera High Level Synthesis Compiler versions 19.1 through 24.3, which arises from an uncontrolled search path element that could lead to search order hijacking...

Yandex Messenger security vulnerability

Yandex Messenger is an instant messaging application from the Russian company Yandex. A security vulnerability exists in Yandex Messenger versions prior to 2.245, which stems from improper control of the search path element and may lead to search order hijacking...

Yandex Telemost security vulnerabilities

Yandex Telemost is an application for easily creating video calls or video chats from the Russian company Yandex. A security vulnerability exists in Yandex Telemost versions prior to 2.19.1, which stems from improper control of the search path element and could lead to search order hijacking...

Siemens SIMATIC S7-1500 Untrusted Search Path (CVE-2022-26488)

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabl...

CVE-2025-40763

A vulnerability has been identified in Altair Grid Engine All versions V2026.0.0. Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary...

CVE-2025-40763

A vulnerability has been identified in Altair Grid Engine All versions V2026.0.0. Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary...

EUVD-2025-106751

A vulnerability has been identified in Altair Grid Engine All versions V2026.0.0. Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary...

CVE-2025-40763

A vulnerability has been identified in Altair Grid Engine All versions V2026.0.0. Affected products do not properly validate environment variables when loading shared libraries, allowing path hijacking through malicious library substitution. This could allow a local attacker to execute arbitrary...