Total
1098 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-14625 | 3 Altera, Intel, Microsoft | 4 Quartus Prime Lite, Quartus Prime Standard, Quartus Prime and 1 more | 2026-01-28 | 6.7 Medium |
| Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Shell modules) allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 19.1 through 24.1; Quartus Prime Lite: from 19.1 through 24.1. | ||||
| CVE-2025-30248 | 1 Westerndigital | 1 Wd Discovery | 2026-01-27 | N/A |
| DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement of a crafted dll in the installer's search path. | ||||
| CVE-2026-21408 | 1 Fujifilm | 1 Beat-access For Windows | 2026-01-27 | N/A |
| beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with SYSTEM privileges. | ||||
| CVE-2025-71178 | 1 Micron | 1 Crucial Storage Executive | 2026-01-27 | N/A |
| Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and loads Windows DLLs using an uncontrolled search path, which can cause a malicious DLL placed alongside the installer to be loaded instead of the intended system library. A local attacker who can convince a victim to run the installer from a directory containing the attacker-supplied DLL can achieve arbitrary code execution with administrator privileges. | ||||
| CVE-2025-30167 | 1 Jupyter | 1 Jupyter Core | 2026-01-23 | 7.3 High |
| Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected `%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with appropriately restrictive permissions (e.g. controlled by administrators _or_ the current user). | ||||
| CVE-2025-65118 | 1 Aveva | 2 Application Server, Process Optimization | 2026-01-22 | 8.8 High |
| The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server. | ||||
| CVE-2026-21427 | 1 Pioneer | 10 Stellanova Lite Aps-s201jgl, Stellanova Lite Aps-s201jgr, Stellanova Lite Aps-s201jr and 7 more | 2026-01-22 | N/A |
| The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privileges of the running installer. | ||||
| CVE-2025-14406 | 1 Sodapdf | 2 Soda Pdf, Soda Pdf Desktop | 2026-01-21 | N/A |
| Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Soda PDF Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25793. | ||||
| CVE-2025-10215 | 2 Microsoft, Updf | 2 Windows, Updf | 2026-01-20 | 7.8 High |
| DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\Public\AppData\Local\UPDF\FREngine\Bin64\' directory, which could lead to arbitrary code execution and persistence. | ||||
| CVE-2025-10198 | 2 Lizardbyte, Microsoft | 2 Sunshine, Windows | 2026-01-20 | 7.8 High |
| Sunshine for Windows, version v2025.122.141614, contains a DLL search-order hijacking vulnerability, allowing attackers to insert a malicious DLL in user-writeable PATH directories. | ||||
| CVE-2025-14405 | 1 Pdfsam | 1 Enhanced | 2026-01-15 | 6.8 Medium |
| PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867. | ||||
| CVE-2023-53937 | 1 Hubstaff | 1 Hubstaff | 2026-01-14 | 7.8 High |
| Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application startup. | ||||
| CVE-2022-50808 | 1 Coolermaster | 1 Masterplus | 2026-01-14 | 8.4 High |
| CoolerMaster MasterPlus 1.8.5 contains an unquoted service path vulnerability in the MPService that allows local attackers to execute code with elevated system privileges. Attackers can drop a malicious executable in the service path and trigger code execution during service startup or system reboot. | ||||
| CVE-2023-28745 | 1 Intel | 1 Qsfp\+ Configuration Utility | 2026-01-14 | 6.7 Medium |
| Uncontrolled search path in Intel(R) QSFP+ Configuration Utility software, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
| CVE-2025-14596 | 3 Altera, Intel, Microsoft | 3 Quartus Prime Pro, Quartus Prime, Windows | 2026-01-12 | 6.7 Medium |
| Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1. | ||||
| CVE-2025-14599 | 3 Altera, Intel, Microsoft | 4 Quartus Prime Lite, Quartus Prime Standard, Quartus Prime and 1 more | 2026-01-12 | 6.7 Medium |
| Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; Quartus Prime Lite: from 23.1 through 24.1. | ||||
| CVE-2025-14605 | 3 Altera, Intel, Microsoft | 3 Quartus Prime Pro, Quartus Prime, Windows | 2026-01-12 | 6.7 Medium |
| Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1. | ||||
| CVE-2025-13670 | 3 Altera, Intel, Microsoft | 3 High Level Synthesis Compiler, High Level Synthesis Compiler, Windows | 2026-01-12 | 6.7 Medium |
| The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability | ||||
| CVE-2025-13669 | 3 Altera, Intel, Microsoft | 3 High Level Synthesis Compiler, High Level Synthesis Compiler, Windows | 2026-01-12 | 6.7 Medium |
| Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level Synthesis Compiler: from 19.1 through 24.3. | ||||
| CVE-2025-13664 | 3 Altera, Intel, Microsoft | 3 Quartus Prime Standard, Quartus Prime, Windows | 2026-01-12 | 6.7 Medium |
| A potential security vulnerability in Quartus® Prime Standard Edition Design Software may allow escalation of privilege. | ||||