By weakness (CWE)

CWE-427: related vulnerabilities

CVEs classified under CWE-427. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

21 published vulnerabilities

• CVE-2026-49241HIGH 8.8

  The Angular Language Service VS Code Extension allows developers to write Angular code with advanced IDE features like autocomplete and error checking. A critical flaw in versions before 21.2.4 lets an attacker hide malicious code in a project repository that automatically executes when a developer opens that folder in VS Code. The attack works by placing a fake TypeScript library file in the repository and configuring VS Code settings to point to it—the extension loads and runs this fake library without asking permission or checking if the workspace is trusted. An attacker only needs to commit the malicious code to a repository (like on GitHub) and wait for developers to clone and open it.

• CVE-2026-54232HIGH 8.8

  vLLM, a popular inference engine for large language models, has a critical supply-chain vulnerability in versions before 0.22.1. The Dockerfile attempts to install a custom package (flashinfer-jit-cache) from a private index, but misconfigures Python's package resolution to also search PyPI. An attacker could register a malicious version of that package on PyPI, which would be installed during container builds with full root privileges. This allows arbitrary code execution and container backdooring, potentially compromising all prompts, credentials, and model data in production deployments.

• CVE-2026-7870HIGH 8.8

  IBM i versions 7.3 through 7.6 contain a privilege escalation vulnerability arising from improper library resolution. An authenticated user can exploit unqualified library calls to execute arbitrary code with administrator privileges, effectively bypassing access controls. The vulnerability requires valid system access but can be triggered without user interaction, making it a significant risk in environments where IBM i hosts business-critical applications.

• CVE-2026-44358HIGH 8.2

  Espressif's Shared GitHub DangerJS Action, a reusable CI workflow component, contains a privilege escalation vulnerability in versions prior to 1.0.1. When processing pull requests from forks, the action's entrypoint script executes DangerJS from an untrusted search path after copying fork code into the working directory. This allows fork-supplied code to run inside the action container with the permissions of the workflow, rather than the action's own trusted code. An attacker can exploit this by submitting a malicious pull request from a fork, causing arbitrary code execution in the CI/CD environment.

• CVE-2026-57239HIGH 8.2

  A vulnerability in Foxit PDF Editor, Foxit PDF Reader, and Microsoft Windows allows low-privilege users to execute arbitrary code with system-level privileges. The flaw stems from these applications executing user-controlled files without proper validation, enabling attackers to escalate their privileges to NT AUTHORITY\SYSTEM. An attacker needs local access and user interaction to trigger the vulnerability, but once exploited, gains complete control over the affected system.

• CVE-2026-10847HIGH 7.8

  Check Point Identity Agent Full for Windows contains a local privilege escalation flaw that allows an authenticated user already logged into a Windows machine to run code with SYSTEM-level permissions. The vulnerability stems from how the application resolves executables during its log collection process. An attacker with regular user access could exploit this to gain complete control over the affected endpoint.

• CVE-2026-36574HIGH 7.8

  CactusViewer v2.3.0 contains a DLL hijacking vulnerability that allows an attacker to execute arbitrary code and escalate privileges on a system where the application is installed. The flaw occurs because the application loads dynamic libraries in an unsafe manner, enabling an attacker to place a malicious DLL in a location the application searches before legitimate system libraries. When CactusViewer runs, it loads the attacker's malicious code instead of the legitimate library, granting the attacker the same privilege level as the user running the application.

• CVE-2026-38972HIGH 7.8

  Notepad3 versions up to 6.25.822.1 contain a DLL search-order hijacking flaw that allows a local attacker to inject malicious code. When a user opens the About dialog, the application attempts to load a library file (MSFTEDIT.DLL) by name alone, without specifying a full path. An attacker who can write files to the application's directory or to other locations Windows searches for DLLs can plant a malicious version and achieve arbitrary code execution under the user's privileges. This is a classic privilege-escalation and code-execution vector that requires local file-system access but no special user privileges to exploit.

• CVE-2026-50100HIGH 7.8

  Ricoh and KONICA MINOLTA printer drivers contain a privilege escalation flaw that allows an authenticated local user to gain elevated system permissions. An attacker with login access to a machine running one of these affected drivers can exploit a specially crafted driver to escalate from their current privilege level to administrator or system-level access. This is a local attack that requires prior authentication—not a remote vulnerability—but the impact of successful exploitation is severe.

• CVE-2026-53813HIGH 7.8

  OpenClaw versions before 2026.4.25 contain a vulnerability that allows attackers with workspace access to load executable code or access data from the wrong locations on a system. The flaw stems from how the application resolves where to find memory-core artifacts based on workspace settings, creating a path traversal opportunity. An attacker who already has some level of access to an affected workspace can exploit this to run malicious code with the privileges of the OpenClaw process.

• CVE-2026-54672HIGH 7.8

  electron-updater, a component used to deploy automatic updates in Electron-based applications, contains a privilege escalation vulnerability affecting versions before 26.15.0. When AppImage packages are built using app-builder-lib, the dynamic library loader path (LD_LIBRARY_PATH) is set with an empty component that causes the current working directory to be searched for shared libraries. An attacker with local access can exploit this by placing a malicious library in the directory where an AppImage is executed, leading to arbitrary code execution with the privileges of the user running the application.

• CVE-2026-56437HIGH 7.8

  Pupsman installers prior to version 3.9.0 are vulnerable to arbitrary code execution if an attacker places a malicious DLL file in the same directory as the installer. When a user runs the installer, the vulnerable search path mechanism loads the attacker's DLL instead of the legitimate one, executing malicious code with full system privileges. This is a local attack that requires user interaction—specifically, running the installer—but poses severe risk in shared environments or scenarios where users download installers to predictable locations.

• CVE-2026-8637HIGH 7.8

  LanSchool Classic contains a vulnerability where the application searches for files or libraries in locations that an authenticated local user can manipulate. An attacker with local access could place malicious files in predictable locations and trick the application into loading them with elevated privileges, leading to complete system compromise. This is a local-only issue requiring prior system access, but the damage potential is severe.

• CVE-2026-47937HIGH 7.7

  Adobe Acrobat Reader contains a flaw in how it searches for and loads libraries or components from the file system. An attacker with administrator or elevated system privileges could craft a malicious file that, when opened by a user, tricks the application into running attacker-controlled code with the same permissions as the user who opened the file. The vulnerability requires both high system privileges to set up and user action to trigger—someone must explicitly open the crafted file.

• CVE-2026-44609HIGH 7.3

  Acronis DeviceLock DLP for Windows contains a local privilege escalation flaw rooted in insecure executable (EXE) hijacking. An attacker with local system access and user-level privileges can exploit this vulnerability by substituting a legitimate executable that the application loads, forcing the system to run malicious code with elevated permissions. This is a user-interaction scenario—the victim must perform an action that triggers the vulnerable code path—but once activated, it grants an attacker full system control over the affected machine.

• CVE-2026-44682HIGH 7.3

  Acronis DeviceLock DLP for Windows contains a vulnerability that allows a local user to gain elevated system privileges through DLL hijacking. An attacker with basic user-level access can exploit this flaw to escalate to administrator or system privileges, potentially compromising the entire endpoint. The vulnerability requires the user to interact with the application, such as launching a dialog or feature that triggers the malicious DLL load.

• CVE-2026-50033HIGH 7.3

  Acronis DeviceLock DLP for Windows contains a local privilege escalation flaw caused by insecure DLL loading. An authenticated user with limited privileges can trick the application into loading a malicious DLL from an attacker-controlled location, gaining elevated system rights. The vulnerability requires local access and user interaction, but can result in complete system compromise.

• CVE-2026-41567HIGH 7.2

  A critical weakness in Moby (the open-source container runtime underlying Docker) allows a malicious container to execute code with full daemon privileges—potentially gaining root access to the host system. The vulnerability occurs when compressed files are uploaded into a container using `docker cp` or the API endpoint `PUT /containers/{id}/archive`. Instead of using decompression tools from the host system, Moby incorrectly uses tools from inside the container itself. If a container image contains a trojanized decompression binary (like xz or unpigz), attackers can exploit this ordering mistake to run arbitrary commands with daemon-level privileges. Versions before Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14 are affected.

• CVE-2024-22447MEDIUM 6.7

  Dell Peripheral Manager versions before 1.7.3 contain a vulnerability that allows an attacker with local access to execute arbitrary code by placing a malicious DLL file in a location that the application searches during startup. The flaw stems from the application not properly validating the search path for required libraries, a weakness commonly exploited to hijack legitimate software execution.

• CVE-2024-22451MEDIUM 6.7

  Dell Peripheral Manager versions 1.5.1 through 1.7.2 contain a vulnerability that allows an attacker with local access to execute arbitrary code by placing malicious files in locations the software searches when loading libraries or executables. An attacker would need valid credentials and user interaction to trigger the exploit, but successful exploitation could give them the same permissions as the user running the affected application.

• CVE-2025-13162MEDIUM 4.4

  CVE-2025-13162 is a search path vulnerability affecting ABB's industrial automation software—specifically Control Builder A and the 800xA system for Advant Master. An authenticated local user with limited privileges can manipulate the application's search path to cause unintended file or library loading, potentially leading to unauthorized modifications or unexpected behavior. The vulnerability requires user interaction and a somewhat difficult exploitation path, making it moderately concerning rather than critical. It does not currently appear on CISA's KEV catalog.