CVE-2025-14596

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro

Installer (SFX)

on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Jan 7, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-145989.8BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability eCVE-2025-145996.7Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite  ICVE-2025-146009.3An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating appCVE-2025-146018.6An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operatiCVE-2025-146025.3The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacCVE-2025-146038.8The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection,CVE-2025-146047.8IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to uniCVE-2025-146056.7Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order HijackingCVE-2025-146065.0A security vulnerability has been detected in tiny-rdm Tiny RDM up to 1.2.5. Affected by this vulnerability is the function pickle.loads of CVE-2025-146076.3A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the fiCVE-2025-146085.3The WP Last Modified Info plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.5CVE-2025-146095.3The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to m
CVE-2025-14596: Medium severity, CVSS 6.7 | Vulnix