Lenovo vulnerabilities
401 CVEs and advisories name Lenovo as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-13154An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated loca
- CVE-2025-13155An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with
- CVE-2025-13152A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local au
- CVE-2025-12046A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated us
- CVE-2025-12048An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow
- CVE-2025-12047A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances,
- CVE-2025-10495A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client application
- CVE-2025-8485An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elev
- CVE-2025-8421An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could a
- CVE-2025-11193A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to s
- CVE-2025-10699A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure.
- CVE-2025-10581A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a lo
- CVE-2025-9548A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated
- CVE-2025-8486A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges.
- CVE-2025-6026An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of
- CVE-2025-8061A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Leno
- CVE-2025-8557An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a
- CVE-2025-9214A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or mo
- CVE-2025-9319A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions.
- CVE-2025-9201A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local use
- CVE-2025-8098An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.
- CVE-2025-4371A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical acce
- CVE-2025-4657A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Len
- CVE-2025-6249An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions
- CVE-2025-6248A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information i
- CVE-2025-6232An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute co
- CVE-2025-6231An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute co
- CVE-2025-6230A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execu
- CVE-2025-1729A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to
- CVE-2025-0886An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to esc