Filtered by vendor Lenovo
Subscriptions
Total
445 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-0421 | 1 Lenovo | 4 Thinkpad L13 Gen 6 2 In 1 Bios, Thinkpad L13 Gen 6 Bios, Thinkpad L14 Gen 6 Bios and 1 more | 2026-01-16 | 6.5 Medium |
| A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being disabled even when configured as “On” in the BIOS setup menu. This issue only affects systems where Secure Boot is set to User Mode. | ||||
| CVE-2025-13154 | 1 Lenovo | 1 Vantage | 2026-01-16 | 5.5 Medium |
| An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges. | ||||
| CVE-2025-13455 | 1 Lenovo | 4 Thinkplus Fu100, Thinkplus Fu200, Thinkplus Tsd303 and 1 more | 2026-01-16 | 7.8 High |
| A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint. | ||||
| CVE-2025-14058 | 1 Lenovo | 31 Idea Tab Pro Tb373fu, Idea Tab Tb336fu, Legion Tab Tb320fc and 28 more | 2026-01-16 | 3.2 Low |
| A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Control Center settings if the device is locked when the "Allow Control Center access when locked" option is disabled. | ||||
| CVE-2025-13453 | 1 Lenovo | 4 Thinkplus Fu100, Thinkplus Fu200, Thinkplus Tsd303 and 1 more | 2026-01-16 | 6.8 Medium |
| A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive. | ||||
| CVE-2025-13454 | 1 Lenovo | 4 Thinkplus Fu100, Thinkplus Fu200, Thinkplus Tsd303 and 1 more | 2026-01-16 | 4.7 Medium |
| A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information. | ||||
| CVE-2021-3453 | 1 Lenovo | 42 730s-13iml, 730s-13iml Firmware, Ideacentre Aio 5-24imb05 and 39 more | 2025-12-16 | 6.8 Medium |
| Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage. | ||||
| CVE-2025-13155 | 1 Lenovo | 1 Baiying Client | 2025-12-12 | 7.8 High |
| An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privileges. | ||||
| CVE-2025-13152 | 1 Lenovo | 1 One Client | 2025-12-12 | 7.8 High |
| A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges. | ||||
| CVE-2025-12046 | 1 Lenovo | 2 App Store, Browser | 2025-12-12 | 7.8 High |
| A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions. | ||||
| CVE-2025-8485 | 1 Lenovo | 1 App Store | 2025-11-14 | 7.3 High |
| An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application. | ||||
| CVE-2025-8421 | 1 Lenovo | 1 Dock Manager | 2025-11-14 | 6.6 Medium |
| An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with elevated privileges. | ||||
| CVE-2025-10495 | 1 Lenovo | 4 App Store, Browser, Legion Zone and 1 more | 2025-11-14 | 7.5 High |
| A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code. | ||||
| CVE-2025-12047 | 1 Lenovo | 1 Scanner Pro | 2025-11-14 | 5.3 Medium |
| A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to disclose sensitive user files from the application. | ||||
| CVE-2025-12048 | 1 Lenovo | 1 Scanner Pro | 2025-11-14 | 7.5 High |
| An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system. | ||||
| CVE-2025-11193 | 1 Lenovo | 2 Tablet, Yoga | 2025-11-10 | 5.5 Medium |
| A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information. | ||||
| CVE-2017-5638 | 7 Apache, Arubanetworks, Hp and 4 more | 13 Struts, Clearpass Policy Manager, Server Automation and 10 more | 2025-10-22 | 9.8 Critical |
| The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string. | ||||
| CVE-2025-6026 | 1 Lenovo | 1 Universal Device Client | 2025-10-21 | 3.1 Low |
| An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of intercepting network traffic to obtain application metadata, including device information, geolocation, and telemetry data. | ||||
| CVE-2025-8486 | 1 Lenovo | 1 Pcmanager | 2025-10-21 | 7.8 High |
| A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges. | ||||
| CVE-2025-10581 | 1 Lenovo | 1 Pcmanager | 2025-10-21 | 7.8 High |
| A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges. | ||||