CVE-2026-75941

HighCVSS 8.0/10Last modified Oct 16, 2026

Description

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-759432.6A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CL CVE-2026-759442.6A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently r CVE-2026-759452.6A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.CVE-2026-759468.2A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could p CVE-2026-759488.6Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `im CVE-2026-7594910.0Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepte CVE-2026-75956.3A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function _format_plugins of CVE-2026-759506.9Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed us CVE-2026-759516.9Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3 CVE-2026-759524.6Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-chang CVE-2026-759537.5Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_i CVE-2026-759549.3Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concate