CVE-2026-26359

Dell Unisphere for PowerMax, versions 10.2, contains an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files...

CVE-2026-21878

The vulnerability CVE-2026-21878 affects BACnet Stack (open source C library) prior to version 1.5.0.rc3, due to lack of validation of user-provided file paths in the file-writing functionality. Affected code paths include apps/readfile/main.c and ports/posix/bacfile-posix.c. The issue allows wri...

Symfony Process Component < 5.4.51 / 6.4.x < 6.4.33 / 7.3.x < 7.3.11 / 7.4.x < 7.4.5 / 8.0.x < 8.0.5 Argument Injection (GHSA-r39x-jcww-82v6)

The version of Symfony Process Component installed on the remote host is prior to 5.4.51, or 6.4.x prior to 6.4.33, or 7.3.x prior to 7.3.11, or 7.4.x prior to 7.4.5, or 8.0.x prior to 8.0.5. It is, therefore, affected by an argument injection vulnerability. The Symfony Process component did not...

curl security update

An update is available for curl. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for...

ITSsourcecode School Management System SQL Injection Vulnerability

itsourcecode School Management System is an open-source school management system developed by itsourcecode. Version 1.0 of itsourcecode School Management System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter “txtsearch” in the file...

Intel Killer Software < 40.25.509.1465 Escalation of Privilege (INTEL-SA-01377)

The version of Intel Killer Software installed on the remote host is prior to 40.25.509.1465. It is, therefore, affected by an escalation of privilege vulnerability as referenced in the INTEL-SA-01377 advisory. - An uncontrolled search path vulnerability exists in some Intel Killer Performance...

EUVD-2020-30872

Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious code. Attackers can exploit the unquoted path to replace the service binary with a malicious executable, enabling...

FUJIFILM Beat-Access code issue vulnerabilities

FUJIFILM beat-access is a remote access client software developed by Fujifilm, a Japanese company. FUJIFILM beat-access versions 3.0.3 and earlier have a code vulnerability that stems from issues with the DLL search path. This vulnerability may allow arbitrary code to be executed with SYSTEM...

CVE-2025-71178 Crucial Storage Executive < 11.08.082025.00 Installer DLL Preloading LPE

Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and loads Windows DLLs using an uncontrolled search path, which can cause a malicious DLL placed alongside the installer t...

CVE-2020-36935

KMSpico 17.1.0.0 contains an unquoted service path vulnerability in the Service KMSELDI configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in C:\Program Files\KMSpico\ServiceKMS.exe to inject malicious executables and...

WordPress plugin Powerlift has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2021-47886 Pingzapper 2.3.1 - 'PingzapperSvc' Unquoted Service Path

Pingzapper 2.3.1 contains an unquoted service path vulnerability in the PingzapperSvc service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files x86\Pingzapper\PZService.exe' to inject malicious executables and escalate...

CVE-2021-47859

ActivIdentity 8.2 contains an unquoted service path vulnerability in the ac.sharedstore service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path in C:\Program Files\Common Files\ActivIdentity\ to inject malicious executables and...

D-Link D-View 8 code issues and vulnerabilities

D-Link D-View 8 is a comprehensive network management software developed by D-Link Corporation. Versions of D-Link D-View 8 2.0.1.107 and earlier contained a code vulnerability. This vulnerability stemmed from an uncontrolled search path within the installer, which could lead to DLL preloading an...

MiracleLinux 9 : postgresql:15 (AXSA:2023-6293:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6293:01 advisory. postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after...

CVE-2025-15500

The CVE-2025-15500 entry describes a remote OS command injection in Sangfor Operation and Maintenance Management System (versions up to 3.0.8) via the HTTP POST Request Handler, specifically manipulating the sessionPath parameter for /isomp-protocol/protocol/getHis. Exploitation is public. Affect...

CVE-2023-49437

Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList...

CVE-2019-11528

An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable...

CVE-2021-41097

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will b...

CVE-2025-14605

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows System Console modules allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1...