CVE-2026-9046

HighCVSS 7.0/10Last modified Jul 16, 2026

Description

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-277

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2026
Last modified
Jul 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-904607.6An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, applicatCVE-2026-904616.3OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) BCVE-2026-904625.4A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-opeCVE-2026-904634.0A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted servicCVE-2026-904666.5Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix maCVE-2026-904674.0aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MCVE-2026-90477.6Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knCVE-2026-904725.3msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays anCVE-2026-904735.3msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with CVE-2026-904746.8MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authenticatCVE-2026-90484.3The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.fCVE-2026-904819.2In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate p
CVE-2026-9046: High severity, CVSS 7.0 | Vulnix