Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 510

Export CSV
CVE-2026-11813

Local Authenticated User Privilege Escalation in Lenovo FileZ Client

A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Filez Client Filez Enterprise
CVE-2026-2640

Local Privilege Escalation: Termination of Privileged Processes in Lenovo PC Manager

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Pc Manager Pcmanager
CVE-2026-0827

Local Privilege Escalation via Arbitrary File Write in Lenovo Diagnostics and Vantage

During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareScanAddin used in Lenovo Vantage that, during installation or when using hardware scan, could allow a local authenticated user to perform an arbitrary file write with elevated privileges.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Diagnostics Hardware Scan Vantage
CVE-2026-1652

Buffer Overflow in Lenovo Smart Connect Virtual Bus Driver Causing Windows BSOD

A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to corrupt memory and cause a Windows blue screen error.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Smart Connect
CVE-2026-1653

Local Divide‑by‑Zero Vulnerability in Lenovo Smart Connect Virtual Bus Driver Causing Blue Screen

A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to cause a Windows blue screen error.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Smart Connect
CVE-2026-2368

Improper Certificate Validation in Lenovo FileZ Allows Arbitrary Code Execution

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to execute arbitrary code.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Filez
CVE-2026-1068

Improper Certificate Validation in Lenovo FileZ Allows Sensitive Data Interception

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Filez
CVE-2026-0520

Local Authenticated User Can Read Sensitive Data from Log File in Lenovo FileZ Android App

A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrieve some sensitive data stored in a log file.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Filez
CVE-2026-14256

Out-of-Bounds Write in Lenovo ELAN TrackPoint Driver Enables Local Denial of Service

ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
100w Gen 4 Laptop Lenovo Elan Trackpoint Driver For Windows 11 Version 22h2 Or Later - Lenovo 100w Gen 4 300w Yoga Gen 4 500w Yoga Gen 4 100w Gen 5 Type 83ld 83le Laptop Lenovo Elan Trackpoint Driver For Windows 11 Version 23h2 Or Later - Lenovo 100w Gen 5 300w 2-in-1 Gen 5 500w 2-in-1 Gen 5 11e Yoga Gen 6 Type 20se 20sf Laptop Thinkpad Elan Clickpad Driver For Windows 11 Version 21h2 Or Later 10 Version 1809 Or Later - Thinkpad Yoga 11e 6th Gen and 259 more
CVE-2026-6387

Local Privilege Escalation via Authentication Bypass in Lenovo System Update

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
System Update
CVE-2026-63424

Improperly Protected Key Enables Local Privilege Escalation in Lenovo Dock Manager

During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Dock Manager
CVE-2026-12036

Local Authenticated User Can Delete Arbitrary Files Using Improper Link Following in Lenovo Vantage Addin

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Vantage
CVE-2026-63425

Improper Permissions in Lenovo Dock Manager Allowing Local Privilege Escalation

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Dock Manager
CVE-2026-63423

Local Privilege Escalation in Lenovo Accessories and Display Manager

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Accessories And Display Manager
CVE-2026-15994

Local Authenticated Improper Link Following Enables Privilege Escalation in Lenovo Vantage

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Commercial Vantage Vantage
CVE-2026-16791

Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI

A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker to overwrite or truncate arbitrary local files with program-generated data when OneCLI is executed with elevated privileges.

CVSS 4.0 · 1 Low EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Xclarity Essentials Onecli
CVE-2026-16792

Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator

An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Xclarity Orchestrator
CVE-2026-16793

Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Xclarity Orchestrator