CVE-2026-89057

MediumCVSS 6.8/10Last modified Oct 16, 2026

Description

A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-890587.4A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in tCVE-2026-890597.5A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the decCVE-2026-89066.1The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to mCVE-2026-890607.7A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedCVE-2026-890625.5A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated useCVE-2026-890637.5The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all CVE-2026-890645.3The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and incluCVE-2026-890657.1Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers tCVE-2026-890667.8Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow conteCVE-2026-890678.8Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: befCVE-2026-890689.8Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: beforeCVE-2026-890695.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc modul