Lenovo
481 CVEs across 5509 Lenovo products. Browse Lenovo vulnerabilities, severities, and proof-of-concept exploits.
Lenovo products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6387 | High | 7.0 | 2026-08-13 | A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with… |
CVE-2026-63426 | High | 7.1 | 2026-08-13 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform… |
CVE-2026-63425 | High | 7.8 | 2026-08-13 | During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authentic… |
CVE-2026-63424 | High | 7.3 | 2026-08-13 | During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escala… |
CVE-2026-63423 | High | 7.8 | 2026-08-13 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that coul… |
CVE-2026-15994 | High | 7.0 | 2026-08-13 | During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allo… |
CVE-2026-14256 | Medium | 4.7 | 2026-08-13 | ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated… |
CVE-2026-12036 | High | 7.1 | 2026-08-13 | An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authent… |
CVE-2026-16793 | High | 8.8 | 2026-08-04 | An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that… |
CVE-2026-16792 | Medium | 6.1 | 2026-08-04 | An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent… |
CVE-2026-16791 | Low | 3.9 | 2026-08-04 | A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker t… |
CVE-2026-9046 | High | 7.0 | 2026-07-16 | A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chines… |
CVE-2026-6511 | Medium | 5.5 | 2026-07-16 | During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a… |
CVE-2026-14371 | | 2026-07-16 | The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection… | |
CVE-2026-13104 | High | 7.3 | 2026-07-16 | A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execu… |
CVE-2026-13103 | High | 7.3 | 2026-07-16 | A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticate… |
CVE-2026-10590 | Medium | 4.4 | 2026-07-16 | A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interru… |
CVE-2026-10589 | Medium | 6.0 | 2026-07-16 | A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode. |
CVE-2026-10588 | Medium | 4.4 | 2026-07-16 | A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory. |
CVE-2026-10587 | Medium | 6.0 | 2026-07-16 | A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode. |
CVE-2026-9045 | High | 7.8 | 2026-06-10 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that coul… |
CVE-2026-8637 | High | 7.8 | 2026-06-10 | A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to exec… |
CVE-2026-7516 | Medium | 4.3 | 2026-06-10 | A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited… |
CVE-2026-6090 | High | 7.0 | 2026-06-10 | A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with e… |
CVE-2025-10238 | Medium | 6.7 | 2026-06-10 | During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privil… |
CVE-2025-10237 | Medium | 6.7 | 2026-06-10 | During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged lo… |
CVE-2026-6282 | High | 8.1 | 2026-05-13 | A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user… |
CVE-2026-6281 | High | 8.8 | 2026-05-13 | A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execu… |
CVE-2026-4145 | High | 7.8 | 2026-04-15 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform… |
CVE-2026-4135 | Medium | 6.6 | 2026-04-15 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authentic… |
CVE-2026-4134 | High | 7.3 | 2026-04-15 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authentic… |
CVE-2026-1636 | Medium | 6.7 | 2026-04-15 | A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute… |
CVE-2026-0827 | High | 7.1 | 2026-04-15 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareScanAddin used in Lenovo Vantage that, d… |
CVE-2026-2640 | Medium | 5.5 | 2026-03-11 | During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate… |
CVE-2026-2368 | High | 7.1 | 2026-03-11 | An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic t… |
CVE-2026-1717 | Medium | 5.5 | 2026-03-11 | An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenti… |
CVE-2026-1716 | High | 7.1 | 2026-03-11 | An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticate… |
CVE-2026-1715 | High | 7.1 | 2026-03-11 | An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticate… |
CVE-2026-1653 | Medium | 5.5 | 2026-03-11 | A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to cau… |
CVE-2026-1652 | Medium | 6.1 | 2026-03-11 | A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to co… |
CVE-2026-1068 | Medium | 5.3 | 2026-03-11 | An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic t… |
CVE-2026-0940 | Medium | 6.7 | 2026-03-11 | A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execut… |
CVE-2026-0520 | Low | 2.8 | 2026-03-11 | A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrie… |
CVE-2026-0421 | Medium | 6.5 | 2026-01-14 | A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in Secure Boot being d… |
CVE-2025-14058 | Low | 3.2 | 2026-01-14 | A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Contr… |
CVE-2025-13455 | High | 7.8 | 2026-01-14 | A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enro… |
CVE-2025-13454 | Medium | 5.5 | 2026-01-14 | A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device infor… |
CVE-2025-13453 | Medium | 4.6 | 2026-01-14 | A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive. |
CVE-2025-13154 | Medium | 5.5 | 2026-01-14 | An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform a… |
CVE-2025-13155 | High | 7.8 | 2025-12-10 | An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privilege… |
CVE-2025-13152 | High | 7.8 | 2025-12-10 | A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to… |
CVE-2025-12046 | High | 7.8 | 2025-12-10 | A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code… |
CVE-2025-8485 | High | 7.3 | 2025-11-12 | An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges dur… |
CVE-2025-8421 | Medium | 6.6 | 2025-11-12 | An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticat… |
CVE-2025-12048 | High | 7.5 | 2025-11-12 | An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execut… |
CVE-2025-12047 | Medium | 5.3 | 2025-11-12 | A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an att… |
CVE-2025-10495 | High | 7.5 | 2025-11-12 | A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certa… |
CVE-2025-11193 | Medium | 5.5 | 2025-11-03 | A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device spe… |
CVE-2025-9548 | Medium | 5.5 | 2025-10-15 | A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated user to cause a Wi… |
CVE-2025-8486 | High | 7.8 | 2025-10-15 | A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges. |
CVE-2025-6026 | Low | 3.1 | 2025-10-15 | An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of intercepting netwo… |
CVE-2025-10699 | Medium | 5.3 | 2025-10-15 | A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure. |
CVE-2025-10581 | High | 7.8 | 2025-10-15 | A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated u… |
CVE-2025-9319 | High | 7.5 | 2025-09-11 | A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions. |
CVE-2025-9214 | Medium | 5.4 | 2025-09-11 | A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or modify network settin… |
CVE-2025-9201 | High | 7.8 | 2025-09-11 | A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local user to execute code w… |
CVE-2025-8557 | High | 8.8 | 2025-09-11 | An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a device on the local… |
CVE-2025-8061 | High | 7.0 | 2025-09-11 | A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Lenovo consumer noteboo… |
CVE-2025-8098 | High | 7.8 | 2025-08-18 | An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges. |
CVE-2025-4371 | Medium | 6.8 | 2025-08-18 | A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write arbitra… |
CVE-2025-6249 | Medium | 6.7 | 2025-07-17 | An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions access to applicati… |
CVE-2025-6248 | High | 7.4 | 2025-07-17 | A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a w… |
CVE-2025-6232 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-6231 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-6230 | Medium | 5.3 | 2025-07-17 | A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite c… |
CVE-2025-4657 | Medium | 6.7 | 2025-07-17 | A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Le… |
CVE-2025-1729 | Medium | 6.7 | 2025-07-17 | A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privilege… |
CVE-2025-0886 | High | 7.8 | 2025-07-17 | An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges. |
CVE-2025-2503 | High | 7.1 | 2025-05-30 | An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an ele… |
CVE-2025-2502 | High | 7.8 | 2025-05-30 | An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. |
CVE-2025-2501 | High | 7.8 | 2025-05-30 | An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. |
CVE-2025-1479 | Medium | 5.3 | 2025-05-30 | An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to execute arbitrary cod… |
CVE-2024-11679 | Medium | 4.4 | 2025-04-11 | An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privi… |
CVE-2024-12673 | High | 7.8 | 2025-02-12 | An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker t… |
CVE-2024-45102 | Medium | 6.8 | 2025-01-14 | A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instanc… |
CVE-2024-10254 | Medium | 4.7 | 2025-01-14 | A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system… |
CVE-2024-10253 | Medium | 4.7 | 2025-01-14 | A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash. |
CVE-2024-8058 | High | 7.6 | 2024-12-16 | An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device… |
CVE-2024-6001 | High | 8.1 | 2024-12-16 | An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a r… |
CVE-2024-4762 | High | 7.8 | 2024-12-16 | An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escalate privileges. |
CVE-2024-9046 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-5474 | Medium | 5.5 | 2024-10-11 | A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2.0.0.2 that could a… |
CVE-2024-4132 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4131 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4130 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-4089 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33582 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33581 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33580 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-33579 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges. |