CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Also known as DLL preloading, Binary planting, Insecure library loading.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- acronis true imageLocal privilege escalation due to DLL hijacking vulnerability. The following products are...6.7 Medium
- python pymanagerPossible to hijack modules in current working directory5.6 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.8 High
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool9.3 Critical
- anthropic claude, claude desktop - windows +1 moreUncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe)...4.7 Medium
- microsoft vcpkgopenssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)7.8 High
- uvnc ultravncUltraVNC Service version.dll uncontrolled search path7.3 High
- ratoc systems, inc. raid monitoring manager for windowsThe installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load...8.4 High
- om digital solutions corporation workspace (windows edition)The installer for OM Workspace (Windows Edition) Ver 2.4 and earlier insecurely loads Dynamic...8.4 High
- flos freeware notepad2Flos Freeware Notepad2 TextShaping.dll uncontrolled search path7.3 High
- flos freeware notepad2Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path7.3 High
- nickemanarin screentogifDLL Sideloading in ScreenToGif7.8 High
- xcitium openedrA local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2...8.8 High
- libssh, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreLibssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows7.8 High
- ibm trusteer rapport installer, trusteer rapport +1 moreIBM Trusteer Rapport installer affected by uncontrolled search path element vulnerability7.4 High
- sap se gui for windows with active guixtDLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT5.0 Medium
- q-see qsee client, qsee client +1 moreThe installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries ...8.4 High
- uvnc ultravncUltraVNC Windows Service cryptbase.dll uncontrolled search path7.3 High
- acronis cyber protect 17, cyber protect +1 moreLocal privilege escalation due to DLL hijacking vulnerability. The following products are...6.3 Medium
- acronis cyber protect 17, cyber protect +1 moreLocal privilege escalation due to DLL hijacking vulnerability. The following products are...6.3 Medium
- acronis cyber protect cloud agent, agent +1 moreLocal privilege escalation due to DLL hijacking vulnerability. The following products are...7.3 High
- docker compose, cli, command line interface +27 more +29 moreDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.0 High
- dell powerscale onefs,, powerscale onefs +1 moreDell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1,...6.7 Medium
- dell command | intel vpro out of band, command \| intel vpro out of band +1 moreDell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search...8.8 High
- openclawOpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal8.3 High
- digital arts inc. finalcode ver.5 series, finalcode ver.6 series +1 moreThe installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL...8.4 High
- synology presto clientAn uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672...6.7 Medium
- dell repository managerDell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path...7.3 High
- tensorflow, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreTensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.0 High
- pdf-xchange editorPDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.3 High
- owl opds, owlcyberdefense opds-talon +1 moreUncontrolled Search Path Element in Owl opds8.4 High
- owl opds, owlcyberdefense opds-talon +1 moreUncontrolled Search Path Element in Owl opds8.4 High
- owl opds, owlcyberdefense opds-talon +1 moreUncontrolled Search Path Element in Owl opds8.4 High
- ricoh company, ltd. ジョブログ集計/分析ソフトウェア ricohジョブログ集計ツールThe installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue...8.4 High
- openclawOpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling8.6 High
- openclawOpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling7.7 High
- flos freeware notepad2Flos Freeware Notepad2 Msimg32.dll uncontrolled search path7.3 High
- unidocs ezpdf drm reader, ezpdf reader +1 moreUnidocs ezPDF DRM Reader/ezPDF Reader SHFOLDER.dll uncontrolled search path7.3 High
- amd vivado™ documentation navigator installation (windows)A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege...7.3 High
- m-audio m-track duo hdThe installer of M-Track Duo HD version 1.0.0 contains an issue with the DLL search path, which...7.1 High
- dalibo postgresql anonymizerImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges8.0 High
- dalibo postgresql anonymizerImproper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 148.0 High
- amd vivado™ installation (windows)A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege...7.3 High
- amd athlon™ 3000 series mobile processors with radeon™ graphics (formerly codenamed "dali"), athlon™ 3000 series mobile processors with radeon™ graphics (formerly codenamed "picasso"), radeon™ pro w5000 series graphics products +25 more +27 moreA DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve...7.8 High
- No product listedUncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User...5.4 Medium
- No product listedUncontrolled search path in some software installer for some VTune(TM) Profiler software and...5.4 Medium
- artifex mupdfArtifex MuPDF win_main.c get_system_dpi uncontrolled search path7.3 High
- siemens sinec nms, user management component (umc), user management component +2 moreA vulnerability has been identified in SINEC NMS (All versions), User Management Component (UMC) ...8.5 High
- siemens sinec nmsA vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected...8.5 High
- asterisk, sangoma certified asterisk +1 moreast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation0.0 None
- Show moreLoading…