CWE-426

CWE-426 · 4 records · 3 with a public proof-of-concept

Records the NVD classes under CWE-426, highest CVSS first.

  1. HIGH 7CVE-2026-100310public PoC2026-09-25

    GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a mal…

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 6.7CVE-2026-100584public PoC2026-09-26

    OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running in exec allowlist mode could approve an exact executable resolved from PATH but subsequently execute a same-named execut…

    AI risk analysis on Exploit-DB.ai →

  3. UNSCOREDCVE-2026-87723public PoC2026-09-28

    In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute a…

    AI risk analysis on Exploit-DB.ai →

  4. UNSCOREDCVE-2026-684922026-09-23

    An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

    AI risk analysis on Exploit-DB.ai →