Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
Jul 14, 2026Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2026-50438 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.CVE-2026-58636 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2026A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301.CVE-2026-15515 · Other software · Tencent · reported by VulDBMedium 6.4
A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2026-50512 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2026-50511 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.CVE-2026-49161 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate pCVE-2026-2640 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elCVE-2025-63946 · Other software · Tencent · reported by MITREHigh 7.4
A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.
- Product
- Pcmanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2025A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certaiCVE-2025-10495 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.7
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.
- Product
- App Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges.CVE-2025-8486 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2025A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated usCVE-2025-10581 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a local authenticated user to execute code with elevated privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.CVE-2025-49728 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4
Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.CVE-2025-53795 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2025An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.CVE-2025-8098 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and LenCVE-2025-4657 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.4
A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Lenovo App Store could allow a local attacker with elevated privileges to execute arbitrary code.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2025-49738 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025Improper access control in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2025-47993 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper access control in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or oCVE-2025-46014 · Other software · Honor · reported by MITREHigh 8.8
Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an elevCVE-2025-2503 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.9
An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file deletions as an elevated user.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-2502 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2025An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.CVE-2025-2501 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.5
An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2025-29975 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Microsoft PC Manager Elevation of Privilege VulnerabilityCVE-2025-21322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft PC Manager Elevation of Privilege Vulnerability
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system cCVE-2024-10254 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.7
A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.CVE-2024-10253 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.7
A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Microsoft PC Manager Elevation of Privilege VulnerabilityCVE-2024-49051 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft PC Manager Elevation of Privilege Vulnerability
- Product
- Microsoft PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges.CVE-2024-33581 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges.
- Product
- PC Manager AI intelligent scenario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.CVE-2019-6198 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.CVE-2019-6197 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot.CVE-2017-3772 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.5
A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create arCVE-2022-39909 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.1
Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create arbitrary file using symbolic link.
- Product
- Samsung Gear IconX PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 3, 2022DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code.CVE-2022-28792 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute path to prevent dll hijacking.
- Product
- Gear IconX PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 13, 2019PCManager 9.1.3.1 has an improper authentication vulnerability.CVE-2019-5223 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not perform a validation of user-mode data properly, successful exploit could result in malicious code execution.
- Product
- PC Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.