CVE-2026-16755

MediumCVSS 5.3/10Last modified Oct 16, 2026

Description

A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1393

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Lenovo	Smart Camera C33	< 05.02.31.140
Lenovo	Smart Camera C33 Pro	< 05.02.31.140
Lenovo	Smart Camera C35	< 05.02.31.140
Lenovo	Smart Camera RQ3	< 05.02.31.140
Lenovo	Smart Camera XW1	< 05.02.31.140
Lenovo	Smart Network PTZ X5T	< 05.02.31.140
Lenovo	Smart Network PTZ X5Q	< 05.02.31.140
Lenovo	Smart Network PTZ X5E	< 05.02.31.140
Lenovo	Smart Camera X6T	< 05.02.31.140
Lenovo	Smart Camera X6Q	< 05.02.31.140
Lenovo	Smart Camera C5X	< 05.02.31.140
Lenovo	Smart Camera X9T	< 05.02.31.140

References

https://iknow.lenovo.com.cn/detail/442625

Timeline

Published: Oct 16, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-167567.5Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-CVE-2026-167586.4The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and CVE-2026-167596.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument fu CVE-2026-167608.8In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whe CVE-2026-167628.7An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during CVE-2026-167635.3A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/CVE-2026-167646.3A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializer CVE-2026-167657.3A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineCl CVE-2026-167669.8Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed d CVE-2026-167676.5A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the CVE-2026-167685.3A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of CVE-2026-167697.1An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the r