Filtered by vendor Lenovo Subscriptions
Total 472 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-9045 1 Lenovo 2 Accessories And Display Manager, Accessories And Display Manager For Enterprise 2026-06-11 7.8 High
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVE-2025-10237 1 Lenovo 188 L13 (type 20r3, 20r4) Laptops (thinkpad) Bios, L13 2-in-1 Gen 6 (type 21r7, 21r8) Laptops (thinkpad) Bios, L13 2-in-1 Gen 6 Type 21r7 21r8 Laptops Thinkpad Bios and 185 more 2026-06-11 6.7 Medium
During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged local user to perform arbitrary reads or writes to privileged memory regions.
CVE-2025-10238 1 Lenovo 213 E14 Gen 4 (type 21e3, 21e4) Laptops (thinkpad) Bios, E14 Gen 4 Type 21e3 21e4 Laptops Thinkpad Bios, E14 Gen 5 (type 21jr, 21js) Laptop (thinkpad) Bios and 210 more 2026-06-11 6.7 Medium
During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privileged local user to execute code in System Management Mode (SMM).
CVE-2026-6090 1 Lenovo 1 Smart Connect 2026-06-10 7 High
A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVE-2026-8637 1 Lenovo 1 Lanschool Classic 2026-06-10 7.8 High
A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.
CVE-2026-7516 1 Lenovo 1 Application 2026-06-10 4.3 Medium
A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents.
CVE-2022-0354 1 Lenovo 1 System Update 2026-06-02 7.3 High
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.
CVE-2026-6282 1 Lenovo 10 Home Storage Hub T20, Home Storage Hub X20, Personal Cloud A1 and 7 more 2026-05-13 8.1 High
A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.
CVE-2026-6281 1 Lenovo 10 Home Storage Hub T20, Home Storage Hub X20, Personal Cloud A1 and 7 more 2026-05-13 8.8 High
A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.
CVE-2007-2929 1 Lenovo 2 Access Support, Automated Solutions 2026-04-23 N/A
The IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), exposes unsafe methods to arbitrary web domains, which allows remote attackers to download arbitrary code onto a client system and execute this code.
CVE-2008-4589 1 Lenovo 1 Resuce And Recovery 2026-04-23 N/A
Heap-based buffer overflow in the tvtumin.sys kernel driver in Lenovo Rescue and Recovery 4.20, including 4.20.0511 and 4.20.0512, allows local users to execute arbitrary code via a long file name.
CVE-2008-3249 1 Lenovo 1 Thinkvantage System Update 2026-04-23 N/A
The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM.
CVE-2009-0655 1 Lenovo 1 Veriface 2026-04-23 N/A
Lenovo Veriface III allows physically proximate attackers to login to a Windows account by presenting a "plain image" of the authorized user.
CVE-2007-2240 1 Lenovo 2 Access Support, Automated Solutions 2026-04-23 N/A
The IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), does not properly validate digital signatures of downloaded software, which makes it easier for remote attackers to spoof a download.
CVE-2007-1307 2 Intel, Lenovo 2 Pro 1000 Lan Adapter, Thinkpad 2026-04-23 N/A
Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM Lenovo ThinkPad systems, has unknown impact and attack vectors.
CVE-2007-2928 1 Lenovo 2 Access Support, Automated Solutions 2026-04-23 N/A
Format string vulnerability in the IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), allows remote attackers to execute arbitrary code via format string specifiers in unknown data.
CVE-2017-5638 7 Apache, Arubanetworks, Hp and 4 more 13 Struts, Clearpass Policy Manager, Server Automation and 10 more 2026-04-21 9.8 Critical
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2026-0421 1 Lenovo 4 Thinkpad L13 Gen 6 2 In 1 Bios, Thinkpad L13 Gen 6 Bios, Thinkpad L14 Gen 6 Bios and 1 more 2026-04-18 6.5 Medium
A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode.
CVE-2026-4145 1 Lenovo 1 Software Fix 2026-04-17 7.8 High
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
CVE-2026-4135 1 Lenovo 1 Software Fix 2026-04-17 6.6 Medium
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges.