Windows Hello Security Feature Bypass Vulnerability

Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally...

Windows Storage Elevation of Privilege Vulnerability

Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally...

Windows Smart Card Elevation of Privilege Vulnerability

Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally...

CVE-2025-27237

CVE-2025-27237 Vulnerabilidad de escalada de privilegios local en Zabbix Agent/Agent2 para Windows mediante el secuestro del archivo de configuración de OpenSSL. Resumen Campo| Valor ---|--- CVE ID| CVE-2025-27237 CVSS v4.0| 7.3 ALTO CWE| CWE-427: Elemento de ruta de búsqueda no controlado Tipo|...

PT-2026-88630

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: Medium...

Adobe Photoshop 26.x < 26.11.7 / 27.x < 27.7 Multiple Vulnerabilities (APSB26-130)

The version of Adobe Photoshop installed on the remote Windows host is prior to 26.11.7/27.7. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-130 advisory. - Integer Overflow or Wraparound CWE-190 potentially leading to Arbitrary code execution CVE-2026-75771,...

Adobe Photoshop 26.x < 26.11.7 / 27.x < 27.7 Multiple Vulnerabilities (macOS APSB26-130)

The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 26.11.7/27.7. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-130 advisory. - Integer Overflow or Wraparound CWE-190 potentially leading to Arbitrary code execution...

CVE-2024-32019-POC

⚠️ CVE-2024-32019 - PoC 📌 Versiones Afectadas = v1.45.0, = v1.44.0-60, v1.45.0-169 🛠️ Prueba de Concepto CVE-2024-32019 — escalada local de privilegios de ndsudo mediante ruta de búsqueda no confiable. 🔧 Compilar el Exploit root@kitploit: x8664-linux-gnu-gcc -o nvme exploit.c -static 📤 Desplegar en...

CVE-2026-14673

An untrusted search path vulnerability in PostgreSQL's amcheck module allows a user with EXECUTE privileges to escalate privileges or execute arbitrary code. By setting a malicious search path before invoking an amcheck function, an attacker can hijack execution to run arbitrary SQL functions wit...

GHSA-6HWM-XVPH-95VM NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

CVE-2026-9633

A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loc...

CVE-2026-82649

SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...

CVE-2026-82649

SiYuan Windows installer versions &gt;= 2.0.14 and before 3.8.1 contain an uncontrolled search path vulnerability in its NSIS installer . The installer invokes system executables such as TASKKILL by name rather than by absolute path, and because NSIS nsExec::Exec resolves these calls using a sear...

EUVD-2026-68235

SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...

CVE-2026-82649 SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path

SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...

CVE-2026-82649 SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path

SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...

PT-2026-83575

SiYuan Windows installer before version 3.8.1 affected versions = 2.0.14 contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a...

Adobe Substance 3D Painter < 12.1.3 Multiple Vulnerabilities (APSB26-129)

The version of Adobe Substance 3D Painter installed on the remote host is prior or equal to 12.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-129 advisory. - Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104761)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104761 advisory. Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes...

CVE-2026-75768

Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a vict...