CVE-2026-21427

The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running installer...

The installers for multiple PIONEER products may insecurely load Dynamic Link Libraries

Overview The installers for multiple products provided by PIONEER CORPORATION contain the following vulnerability. Uncontrolled search path element CWE-427 - CVE-2026-21427 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

CVE-2026-21427

The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running installer...

CVE-2026-21427

The CVE-2026-21427 issue affects PIONEER CORPORATION installers, where DLL search path handling allows loading insecure libraries (Uncontrolled search path element, CWE-427). Impact: arbitrary code could run with the installer's privileges. Documented by multiple sources (NVD/Red Hat/JVN) as affe...

CVE-2025-14599

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1...

CVE-2025-14614

Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1...

PT-2026-2059

Name of the Vulnerable Software and Affected Versions PIONEER CORPORATION installers affected versions not specified Description The installers for multiple products provided by PIONEER CORPORATION have a flaw in how they handle Dynamic Link Library DLL search paths. This can result in the loadin...

CVE-2025-14614

Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1...

Altera Quartus Prime Standard和Altera Quartus Prime Lite 安全漏洞

Altera Quartus Prime Standard and Altera Quartus Prime Lite are both FPGA design software from Altera Corporation, USA. A security vulnerability exists in Altera Quartus Prime Standard and Altera Quartus Prime Lite that stems from the Windows installer's use of predictable temporary filenames,...

CVE-2025-14614 Quartus® Prime Standard and Quartus® Prime Lite Security Advisory

Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1...

CVE-2025-14614 Quartus® Prime Standard and Quartus® Prime Lite Security Advisory

Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1...

CVE-2025-14599

The CVE-2025-14599 entry concerns an Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Installer (SFX) for Windows. The issue affects Quartus Prime Standard (versions 23.1–24.1) and Quartus Prime Lite (versions 23.1–24.1) and can enable Search Order Hijacking due to an uncont...

CVE-2025-14599 Quartus® Prime Standard and Quartus® Prime Lite Security Advisory

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1...

CVE-2025-14599 Quartus® Prime Standard and Quartus® Prime Lite Security Advisory

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer SFX on Windows, Altera Quartus Prime Lite Installer SFX on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1...

PT-2026-1516

Name of the Vulnerable Software and Affected Versions Altera Quartus Prime Standard versions 23.1 through 24.1 Altera Quartus Prime Lite versions 23.1 through 24.1 Description An uncontrolled search path element issue exists in the Altera Quartus Prime Standard Installer SFX and Altera Quartus...

PT-2025-51858

Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This allows a local low-privileged user to inject arbitrary...

CVE-2024-46062

Miniconda3 macOS installers prior to 23.11.0-1 are affected. During installation outside the user’s home directory, the installer creates world-writable files that are executed with root privileges, enabling a local low-privileged user to inject commands and achieve root-level code execution. Pra...

TamperedChef Malware Spreads via Fake Software Installers in Ongoing Global Campaign

Threat actors are leveraging bogus installers masquerading as popular software to trick users into installing malware as part of a global malvertising campaign dubbed TamperedChef. The end goal of the attacks is to establish persistence and deliver JavaScript malware that facilitates remote acces...

EUVD-2025-175306

Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access...

CVE-2025-30182

Uncontrolled search path for some IntelR Distribution for Python software installers before version 2025.2.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalati...