CWE-426
Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
We have discovered 15,141 live websites that are affected by CWE-426.
CVEs
- Count - 16
CWE References
Website Distribution by Country
Number of websites using CWE-426 United States | 4,207 websites |
 Germany | 2,418 websites |
 France | 691 websites |
 China | 656 websites |
 Italy | 547 websites |
 GB | 450 websites |
 Russia | 346 websites |
 Czech Republic | 341 websites |
 Canada | 332 websites |
 Netherlands | 294 websites |
Website Distribution by TLD
Number of websites using CWE-426| .com | 4,554 websites |
| .de | 1,859 websites |
| .org | 973 websites |
| .net | 627 websites |
| .it | 388 websites |
| .fr | 336 websites |
| .ru | 290 websites |
| .cz | 278 websites |
| .nl | 231 websites |
| .edu | 216 websites |
Newest CVEs
List of the most recent CVEs that are part of CWE-426| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Oct, 2026 | CVE-2026-59265 | Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover | 5,666 |
| Jan, 2026 | CVE-2026-20943 | Microsoft Office Click-To-Run Remote Code Execution Vulnerability | 2,382 |
| Dec, 2025 | CVE-2025-67722 | Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation | 35 |
| Jun, 2025 | CVE-2025-49124 | Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows | 2,716 |
| Feb, 2025 | CVE-2024-3220 | Default mimetype known files writeable on Windows | 422 |
| Dec, 2024 | CVE-2024-53866 | pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion | 1 |
| Jun, 2024 | CVE-2024-30100 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 2,201 |
| Mar, 2024 | CVE-2024-26198 | Microsoft Exchange Server Remote Code Execution Vulnerability | 3,723 |
| Oct, 2023 | CVE-2023-36778 | Microsoft Exchange Server Remote Code Execution Vulnerability | 3,046 |
| Feb, 2023 | CVE-2023-22743 | Git for Windows' installer is susceptible to DLL side loading attacks | 189 |
The most widespread CVEs
List of the most common CVEs that are part of CWE-426| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Oct, 2026 | CVE-2026-59265 | Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover | 5,666 |
| Mar, 2024 | CVE-2024-26198 | Microsoft Exchange Server Remote Code Execution Vulnerability | 3,723 |
| Oct, 2023 | CVE-2023-36778 | Microsoft Exchange Server Remote Code Execution Vulnerability | 3,046 |
| Jan, 2023 | CVE-2023-21763 | Microsoft Exchange Server Elevation of Privilege Vulnerability | 2,801 |
| Jan, 2023 | CVE-2023-21764 | Microsoft Exchange Server Elevation of Privilege Vulnerability | 2,801 |
| Jun, 2025 | CVE-2025-49124 | Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows | 2,716 |
| Jan, 2026 | CVE-2026-20943 | Microsoft Office Click-To-Run Remote Code Execution Vulnerability | 2,382 |
| Jun, 2024 | CVE-2024-30100 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 2,201 |
| Feb, 2025 | CVE-2024-3220 | Default mimetype known files writeable on Windows | 422 |
| Feb, 2023 | CVE-2023-22743 | Git for Windows' installer is susceptible to DLL side loading attacks | 189 |
Websites affected by CWE-426
Top websites that are affected by CWE-426. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ********.****.com | United States | *** | |
| ***.int |  Switzerland | *,*** | |
| ******.gov | United States | *,*** | |
| ****.**.gov | United States | *,*** | |
| ***************.org | United States | *,*** | |
| ****.eu |  Denmark | **,*** | |
| *********.***.es |  Spain | **,*** | |
| ******.***.***.au |  Australia | **,*** | |
| ****.gov | United States | **,*** | |
| **************.com | United States | **,*** |