CVE-2026-104989
Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated att
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 9, 2026 · Last modified: Nov 9, 2026 · CWE-427
Not enough EPSS history yet.
Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-90636.7 MED—
———A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account.6hCVE-2026-865798.2 HIG—
———Binary Planting Vulnerability in Hitachi Dynamic Link Manager for Windows.
This issue affects Hitachi Dynamic Link Manager for Windows: from 5.9.5-00 before 9.0.4-01.7hCVE-2026-1200157.5 HIG—
———SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.11hCVE-2026-1140327.8 HIG—
———The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges.14hCVE-2026-112170——
——0The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.23hCVE-2026-118450——
——0Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.1d