Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-427: Uncontrolled search path element

1,255 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

All 1,255 in the listAtom feed of new CVEsWhat CWE-427 is, at MITRE (opens in a new tab)
Published CVEs
1,255
Last 12 months
269
Critical
28
Known exploited
3

Critical 28High 854Medium 363Low 8Not scored 2

CVEs per yearBy the year they were published

  1. 20051
  2. 20161
  3. 201742
  4. 201824
  5. 201974
  6. 2020105
  7. 2021123
  8. 2022123
  9. 2023148
  10. 2024177
  11. 2025224
  12. 2026213

Known exploitedNewest addition to KEV first

  • CVE-2026-110936

    A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an…

    Siemens · Siemens Software Center

    ExploitedHigh8.4
  • CVE-2020-3433

    Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability

    Cisco · Cisco AnyConnect Secure Mobility Client

    ExploitedHigh7.8
  • CVE-2020-3153

    Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

    Cisco · Cisco AnyConnect Secure Mobility Client

    ExploitedMedium6.5

Newest CVEs

  • CVE-2026-123510

    Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath

    go-vikunja · vikunja

    Low1.0
  • CVE-2019-16447

    Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. Successful exploitation could lead to local code execution.

    Adobe · Adobe Illustrator CC

    High7.8
  • CVE-2026-122133

    Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe

    mistralai · mistral-vibe

    High8.6
  • CVE-2026-59264

    Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer

    Apache Software Foundation · Apache OpenOffice

    High7.8
  • CVE-2026-88066

    Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable

    anthropics · claude-code

    High7.5
  • CVE-2026-28327

    SolarWinds Dameware DLL Hijacking Vulnerability

    SolarWinds · Dameware

    High8.2
  • CVE-2026-62847

    Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

    metalama · Metalama

    High8.2
  • CVE-2026-116243

    pgAdmin 4: Utility binary path can point at a shared storage directory

    pgadmin.org · pgAdmin 4

    High7.7
  • CVE-2026-103665

    The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is…

    Yamaha Corporation · Yamaha LAN Monitor for Windows

    High8.4
  • CVE-2026-118131

    CVE-2026-118131

    GnuPG · GnuPG

    Critical9.8

Vendors it comes up for most

  1. Adobe49
  2. Dell30
  3. Acronis29
  4. Lenovo26
  5. Cisco24
  6. IBM21
  7. Trend Micro19
  8. NVIDIA17
  9. Siemens17
  10. Microsoft16