lenovo

Vendors · lenovo

· 10 Critical403 known vulnerabilities across 4508 products

Total CVEs

403

Critical

Products

4508

Search All CVEs →

403

Products (4508)

Recent Vulnerabilities

View all 403 →

CVE-2026-1717MEDIUM 5.5

An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges.

CVE-2026-1716HIGH 7.1

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges.

CVE-2026-1715HIGH 7.1

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privileges.

CVE-2025-13455HIGH 7.8

A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enroll an untrusted fingerprint.

CVE-2025-13454MEDIUM 5.5

A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information.

CVE-2025-13453MEDIUM 4.6

A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive.

CVE-2025-8485HIGH 7.3

An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application.

CVE-2025-8486HIGH 7.8

A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges.

CVE-2025-10581HIGH 7.8

A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges.

CVE-2025-8098HIGH 7.8

An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.

CVE-2025-6232HIGH 7.8

An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations.

CVE-2025-6231HIGH 7.8

CVE-2025-6230MEDIUM 5.3

A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.

CVE-2025-2503HIGH 7.1

An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an elevated user.

CVE-2025-2502HIGH 7.8

An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.

CVE-2025-2501HIGH 7.8

An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.

CVE-2024-9046HIGH 7.8

A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.

CVE-2024-5474MEDIUM 5.5

A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2.0.0.2 that could allow a local attacker to read files on the system with elevated privileges during installation of the package. Previously installed versions are not affected by this issue.

CVE-2024-4132HIGH 7.8

A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.

CVE-2024-4131HIGH 7.8

A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.

CVE-2024-4130HIGH 7.8

A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.

CVE-2024-4089HIGH 7.8

A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges.

CVE-2024-45104MEDIUM 6.3

A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.

CVE-2024-45103MEDIUM 4.3

A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.

CVE-2023-1577HIGH 7.8

A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute code with elevated privileges.