EUVD-2026-58812

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-13196

Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the...

CVE-2026-63649: Permissive List of Allowed Inputs

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-13196: Out-of-bounds Write

Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the...

CVE-2026-16896

IBM i versions 7.3–7.6 are affected by CVE-2026-16896 (TOCTOU race condition in Network Authentication Service). Local authenticated attackers could obtain unauthorized access to files due to a TOCTOU flaw. Affected products: IBM i 7.3, 7.4, 7.5, 7.6. Remediation: apply the fixed PTFs per version...

CVE-2026-14256

CVE-2026-14256 involves a potential out-of-bounds write in the ELAN TrackPoint driver. Under certain conditions, a local authenticated user could cause a system crash. The available data identifies the affected component (ELAN TrackPoint driver) and the impact (availability loss via crash) but do...

CVE-2026-63423

Technical details about CVE-2026-63423 are not publicly available in the provided documents. Monitor for updates from Lenovo and NVD; no affected products, vectors, or mitigations can be confirmed from the supplied sources.

CVE-2026-63423

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-63425

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-63425

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-58056

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...

PT-2026-71642

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-16896: Time-of-check Time-of-use (TOCTOU) Race Condition

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use TOCTOU race condition...

CVE-2026-14256: Out-of-bounds Read

ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash...

CVE-2026-16898: External Control of File Name or Path

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-18509: Improper Authorization

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system...

CVE-2026-6387: Authentication Bypass by Spoofing

A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-15994: Improper Link Resolution Before File Access

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges...

CVE-2026-63424: Weak Encoding for Password

During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges...

CVE-2026-63423: Use of Hard-coded Cryptographic Key

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...