CWE-427: Uncontrolled search path element
1,250 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.
- Published CVEs
- 1,250
- Last 12 months
- 265
- Critical
- 27
- Known exploited
- 3
Critical 27High 851Medium 363Low 7Not scored 2
CVEs per yearBy the year they were published
- 201824
- 201985
- 20191
- 20203
- 20201
- 2021119
- 2022114
- 2025187
- 2025139
- 2026168
- 2026203
- 2026156
Known exploitedNewest addition to KEV first
- CVE-2026-110936
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an…
Siemens · Siemens Software Center
ExploitedHigh8.4 - CVE-2020-3433
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
Cisco · Cisco AnyConnect Secure Mobility Client
ExploitedHigh7.8 - CVE-2020-3153
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
Cisco · Cisco AnyConnect Secure Mobility Client
ExploitedMedium6.5
Newest CVEs
- CVE-2026-88066
Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable
anthropics · claude-code
High7.5 - CVE-2026-28327
SolarWinds Dameware DLL Hijacking Vulnerability
SolarWinds · Dameware
High8.2 - CVE-2026-62847
Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)
metalama · Metalama
High8.2 - CVE-2026-116243
pgAdmin 4: Utility binary path can point at a shared storage directory
pgadmin.org · pgAdmin 4
High7.7 - CVE-2026-103665
The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is…
Yamaha Corporation · Yamaha LAN Monitor for Windows
High8.4 - CVE-2026-104349
Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)
Adobe · Creative Cloud Desktop Application
High7.3 - CVE-2026-107090
An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Windows installer…
Product not named
High7.8 - CVE-2026-91093
HP One Agent Software – Security Update
HP Inc. · HP One Agent Software
High8.5 - CVE-2026-92202
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
Luxion · KeyShot
High7.8 - CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of…
ASUS · Armoury Crate
High8.5