CVE-2026-119238

LowCVSS 3.3/10Last modified Nov 11, 2026

Description

A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local application to perform unauthorized touch gestures.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-926

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Lenovo	XiangBangbang Application	< 1.0.16

References

https://iknow.lenovo.com.cn/detail/443047

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1192497.5A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to CVE-2026-119252.7Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server.CVE-2026-1192507.8A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman CVE-2026-1192516.7A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for CVE-2026-1192595.3The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing i CVE-2026-119267.5IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request res CVE-2026-1192608.8Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1192619.6Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potent CVE-2026-1192628.8Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1192639.6Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the s CVE-2026-1192648.8Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the s CVE-2026-1192658.8Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer p