CVE-2026-75940

CriticalCVSS 9.1/10Last modified Sep 11, 2026

Description

A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Lenovo	Health Application	<= 1.5.0

References

https://iknow.lenovo.com.cn/detail/442248

Timeline

Published: Sep 10, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-759418.0A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allo CVE-2026-759432.6A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CL CVE-2026-759442.6A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently r CVE-2026-759452.6A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.CVE-2026-759468.2A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could p CVE-2026-759488.6Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `im CVE-2026-7594910.0Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepte CVE-2026-75956.3A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of CVE-2026-759506.9Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed us CVE-2026-759516.9Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3 CVE-2026-759524.6Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-chang CVE-2026-759537.5Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_i