249793 matches found
EUVD-2026-44985
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected...
CVE-2026-10590
A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler...
EUVD-2026-44982
A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler...
CVE-2026-10590
CVE-2026-10590 describes a potential local privilege escalation where an attacker could abuse WMI commands to trigger a System Management Interrupt (SMI) handler due to missing authentication. The CVSS data indicates a LOCAL attack with HIGH privileges required, no user interaction, and potential...
CVE-2026-10589
A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode...
CVE-2026-10589
Technical details (affected product, component, versions, exploitability) are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-44981
A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode...
CVE-2026-10588
A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory...
CVE-2026-10588
Technical details (affected products/components/root cause/fix) are not provided in the supplied documents. Monitor Lenovo advisories and CVE records for updates.
EUVD-2026-44980
A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory...
CVE-2026-10587
CVE-2026-10587 is described in connected documents as a potential out-of-bounds write vulnerability that could allow a local privileged attacker to modify power management settings in System Management Mode. The root cause is an out-of-bounds write; impact is indicated as high on integrity and av...
CVE-2026-10587
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode...
EUVD-2026-44979
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode...
CVE-2026-9046
CVE-2026-9046 describes an insecure-permissions issue affecting Windows deployments of Legion Zone and Lenovo App Store (Chinese market). When installed on a non-system partition, a local user could potentially execute arbitrary code due to insufficient access controls. The vulnerability is class...
EUVD-2026-44975
A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code...
CVE-2026-6511
CVE-2026-6511 : Lenovo Smart Connect for Windows is reported to have an improper access control vulnerability that could allow a local authenticated user to access files owned by another user on the same system. The issue is described as local, with low attack complexity and the attack requires l...
EUVD-2026-44970
stoatchat before 0.14.0 contains a server-side request forgery SSRF vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the urlisblacklisted function, which inspects only the first resolved...
CVE-2026-63088 stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass
stoatchat before 0.14.0 contains a server-side request forgery SSRF vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the urlisblacklisted function, which inspects only the first resolved...
CVE-2026-63081
Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious...
