CVE-2026-1652

MediumCVSS 6.1/10Last modified Aug 20, 2026

Description

A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenticated user to corrupt memory and cause a Windows blue screen error.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2026
Last modified
Aug 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-165208.7Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians GeniaCVE-2026-165247.8A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This faiCVE-2026-165268.8A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this toCVE-2026-165277.3An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows thCVE-2026-165288.4Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentCVE-2026-165297.5A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiCVE-2026-16535.5A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authenCVE-2026-165306.5A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()CVE-2026-165315.3An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. ThCVE-2026-165329.1The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, aCVE-2026-165349.1The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permiCVE-2026-165356.1The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing un
CVE-2026-1652: Medium severity, CVSS 6.1 | Vulnix