CVE-2026-116633
A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write
CVSS
7.1
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 11, 2026 · Last modified: Nov 12, 2026 · CWE-926
Not enough EPSS history yet.
A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write with elevated privileges.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1192383.3 LOW—
——0A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local application to perform unauthorized touch gestures.4hCVE-2026-543768.2 HIG1.6%
——0VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio.cn). Attackers can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.3dCVE-2026-1070597.5 HIG26.6%
——8An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication.9dCVE-2026-1070579.8 CRI33.4%
——10An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.10dCVE-2026-1070517.5 HIG16.2%
——5Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations.10dCVE-2026-1070489.8 CRI45.8%
——14An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.9d