Monthly
Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 is vulnerable to an uncontrolled search path element (CWE-427), enabling a locally authenticated attacker to conduct spoofing attacks with high confidentiality and integrity impact. The flaw stems from the application resolving executables or libraries from attacker-controllable directory paths, a class of vulnerability commonly manifesting as DLL or binary planting on Windows. No public exploit has been identified at time of analysis, and Microsoft has released a patch as of the advisory publication.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 exposes an uncontrolled search path element (CWE-427) that enables an authorized local attacker with standard user privileges to deny service against the Remote Help application. The flaw stems from the application resolving executable dependencies or resources through a controllable or insufficiently constrained search path, allowing a low-privilege local user to interfere with path resolution and crash the process. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a remediation in version 5.2.1040.0.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Arbitrary code execution in CompuGroup Medical CGM ISIS MED 2510.1.0.20 is achievable when a local attacker plants a crafted DLL in a path searched by the application (CWE-427: Uncontrolled Search Path Element). Despite the description labeling this a 'remote' attack, the NVD CVSS vector is AV:L/UI:R, consistent with classic DLL hijacking - delivery of the malicious DLL may occur remotely (phishing, network share), but exploitation is local and requires the victim to launch the application. A proof-of-concept is publicly available per SSVC data and the researcher's GitHub repository, though no CISA KEV listing confirms active exploitation.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.
OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlled directory, Codex can run a malicious hook while processing the repository. The hook executes outside Codex's command sandbox, without user approval, and with the user's privileges, allowing it to read, change, or delete the user's files and access other resources available to the user's account. An ordinary Git clone does not preserve the attacker-controlled repository-local configuration required for exploitation.
Local privilege escalation in SiYuan's Windows NSIS installer affects versions 2.0.14 through 3.8.0, allowing a local attacker with write access to a directory to execute arbitrary code with elevated privileges by planting a malicious binary that the NSIS installer resolves ahead of System32 during an all-users installation. The root cause is electron-builder's preInit hook invoking system utilities such as TASKKILL by short name via nsExec::Exec, causing the installer's launch directory to take search-path precedence over System32 before the license page is even displayed. No public exploit code has been identified at time of analysis, though the binary-planting technique is well-documented in Windows installer security research.
Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 is vulnerable to an uncontrolled search path element (CWE-427), enabling a locally authenticated attacker to conduct spoofing attacks with high confidentiality and integrity impact. The flaw stems from the application resolving executables or libraries from attacker-controllable directory paths, a class of vulnerability commonly manifesting as DLL or binary planting on Windows. No public exploit has been identified at time of analysis, and Microsoft has released a patch as of the advisory publication.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 exposes an uncontrolled search path element (CWE-427) that enables an authorized local attacker with standard user privileges to deny service against the Remote Help application. The flaw stems from the application resolving executable dependencies or resources through a controllable or insufficiently constrained search path, allowing a low-privilege local user to interfere with path resolution and crash the process. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a remediation in version 5.2.1040.0.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CWE-427), allowing a low-privileged local attacker to plant a malicious binary or shared library in a directory that the application resolves before the legitimate path, resulting in code execution under a higher-privileged context. The CVSS 3.1 score of 7.3 reflects full confidentiality, integrity, and availability impact, though the attack is constrained to local access and requires user interaction to trigger the vulnerable operation. Dell has released a fix in version 4.3.0.1 per advisory DSA-2026-328; no public exploit code has been identified at time of analysis.
Arbitrary code execution in CompuGroup Medical CGM ISIS MED 2510.1.0.20 is achievable when a local attacker plants a crafted DLL in a path searched by the application (CWE-427: Uncontrolled Search Path Element). Despite the description labeling this a 'remote' attack, the NVD CVSS vector is AV:L/UI:R, consistent with classic DLL hijacking - delivery of the malicious DLL may occur remotely (phishing, network share), but exploitation is local and requires the victim to launch the application. A proof-of-concept is publicly available per SSVC data and the researcher's GitHub repository, though no CISA KEV listing confirms active exploitation.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.