CVE-2026-10587

MediumCVSS 6.0/10Last modified Jul 16, 2026

Description

A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 16, 2026
Last modified
Jul 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1058707.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2CVE-2026-1058716.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor AddonsCVE-2026-1058727.2Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allowCVE-2026-1058736.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor AddonsCVE-2026-1058747.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allCVE-2026-1058756.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For EleCVE-2026-1058765.3Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This iCVE-2026-1058776.9Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded SensitiCVE-2026-1058785.3Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly CVE-2026-1058796.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jCVE-2026-105884.4A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory.CVE-2026-1058816.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-regi
CVE-2026-10587: Medium severity, CVSS 6.0 | Vulnix