Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-55013] Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to per…

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-56090] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerab…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16860] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code d…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta de secuestro de DLL en LUCID Vision Labs Arena SDK 1.0.80.49

Una vulnerabilidad de tipo DLL Search Order Hijacking (puntuación CVSS 8.8) en Arena SDK 1.0.80.49 permite a atacantes locales ejecutar código arbitrario con los privilegios de la aplicación. El riesgo es alto en entornos de visión artificial e industria 4.0 comunes en plantas manufactureras de México y Latinoamérica, donde este SDK se integra en sistemas de inspección y control de calidad.

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18656] An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remo…

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 1.0.228 or higher.

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18657] An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remot…

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18718] Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allow…

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes t…

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18605] A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown funct…

A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been released to t…

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48388] Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that cou…

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running t…

M Alto vulnerabilidad

28/07/2026

[CVE-2026-8164] Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade…

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop Client: from v2.2.16.10 through 17062026.

M Alto vulnerabilidad

24/07/2026

[CVE-2026-16519] A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The …

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location.

M Alto vulnerabilidad

16/07/2026

[CVE-2026-5674] A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape s…

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

M Alto vulnerabilidad

15/07/2026

[CVE-2026-42936] The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at t…

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48272] Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could r…

Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-0487] SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from a…

SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system.

A Alto vulnerabilidad

13/07/2026

[CVE-2026-48364] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element …

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

A Alto vulnerabilidad

13/07/2026

[CVE-2026-48363] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element …

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15515] A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects …

A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclo…

F Alto vulnerabilidad

08/07/2026

[CVE-2026-57239] The user-controllable executable files will be directly executed by high-privilege processes, allowi…

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.

M Alto vulnerabilidad

08/07/2026

[CVE-2026-56437] Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL f…

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege.

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?