CVE-2026-118450
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files
CVSS
—
Sin CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 9 nov 2026 · Última mod.: 9 nov 2026 · CWE-427
Sin historial EPSS suficiente todavía.
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
- www.acn.gov.ithttps://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- www.cgm.comhttps://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-112170——
———The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.2hCVE-2026-1235103.3 BAJ0.5%
——0Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.1hCVE-2019-164477.8 ALT26.4%
——8Adobe Illustrator CC versions 23.1 and earlier have a binary planting vulnerability. Successful exploitation could lead to local code execution.3dCVE-2026-1221338.8 ALT31.4%
——9Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLogger and ProjectContextProvider run the malicious git.exe at session start before any trust prompt.4dCVE-2026-592647.8 ALT12.4%
——4The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.4dCVE-2026-88066—16.9%
——5Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows invokes git.exe through uv_spawn without an absolute path, allowing Windows search-path resolution to select a malicious git.exe placed in the opened project's current working directory before the intended system executable. Opening an attacker-controlled or shared repository can therefore execute the substituted program with the user's privileges. This issue is fixed in version 1.8089.0.6d