249829 matches found
EUVD-2026-44980
A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory...
CVE-2026-10587
CVE-2026-10587 is described in connected documents as a potential out-of-bounds write vulnerability that could allow a local privileged attacker to modify power management settings in System Management Mode. The root cause is an out-of-bounds write; impact is indicated as high on integrity and av...
CVE-2026-10587
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode...
EUVD-2026-44979
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode...
CVE-2026-9046
CVE-2026-9046 describes an insecure-permissions issue affecting Windows deployments of Legion Zone and Lenovo App Store (Chinese market). When installed on a non-system partition, a local user could potentially execute arbitrary code due to insufficient access controls. The vulnerability is class...
EUVD-2026-44975
A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code...
CVE-2026-6511
CVE-2026-6511 : Lenovo Smart Connect for Windows is reported to have an improper access control vulnerability that could allow a local authenticated user to access files owned by another user on the same system. The issue is described as local, with low attack complexity and the attack requires l...
EUVD-2026-44970
stoatchat before 0.14.0 contains a server-side request forgery SSRF vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the urlisblacklisted function, which inspects only the first resolved...
CVE-2026-63088 stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass
stoatchat before 0.14.0 contains a server-side request forgery SSRF vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the urlisblacklisted function, which inspects only the first resolved...
CVE-2026-63081
Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scripting vulnerability that allows authenticated attackers with Agent-level privileges to inject malicious payloads into the Notes field of assigned support tickets. Attackers can store malicious...
CVE-2026-9292
creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:41+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-09...
CVE-2026-15352
creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:39+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-03 2026-07-16 23:23:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsewl6cyb2e 2026-07-30 23:00:46+00:00| seen|...
CVE-2026-57896
creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:19+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...
CVE-2026-61389
creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:14+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...
CVE-2026-44595
CVE-2026-44595 affects Yamcs’ core IAM API endpoints: GET /api/iam/users, GET /api/iam/users/{name}, GET /api/iam/groups, and GET /api/iam/groups/{name}. The root cause is missing enforcement of SystemPrivilege.ControlAccess in Yamcs’ IAM API (IamApi.java), enabling any authenticated user—even wi...
CVE-2026-63081
The CVE-2026-63081 entry describes a stored XSS in the Perfect Support Ticketing & Document Management System (v1.7). Authenticated attackers with Agent-level privileges can inject scripts into the Notes field of assigned tickets, causing the script to run in the browser context of any viewer (in...
CVE-2026-54568 Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICEINFOREQUEST with another device's targetid and receive that device's server-side systeminfo through...
Important: Red Hat Bug Fix Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: XFS data corruption using reflink For more details about the security issues,...
CVE-2026-56456
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...
