CVE-2026-16754

MediumCVSS 4.8/10Last modified Oct 16, 2026

Description

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LenovoSmart Camera C33< 05.02.31.140
LenovoSmart Camera C33 Pro< 05.02.31.140
LenovoSmart Camera C35< 05.02.31.140
LenovoSmart Camera RQ3< 05.02.31.140
LenovoSmart Camera XW1< 05.02.31.140
LenovoSmart Network PTZ X5T< 05.02.31.140
LenovoSmart Network PTZ X5Q< 05.02.31.140
LenovoSmart Network PTZ X5E< 05.02.31.140
LenovoSmart Camera X6T< 05.02.31.140
LenovoSmart Camera X6Q< 05.02.31.140
LenovoSmart Camera C5X< 05.02.31.140
LenovoSmart Camera X9T< 05.02.31.140

References

Timeline

Published
Oct 16, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-167555.3A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthCVE-2026-167567.5Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-CVE-2026-167586.4The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, andCVE-2026-167596.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument fuCVE-2026-167608.8In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set wheCVE-2026-167628.7An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption duringCVE-2026-167635.3A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/CVE-2026-167646.3A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializerCVE-2026-167657.3A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClCVE-2026-167669.8Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed dCVE-2026-167676.5A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of theCVE-2026-167685.3A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of
CVE-2026-16754: Medium severity, CVSS 4.8 | Vulnix