CVE-2026-6511
During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows
CVSS
5.5
Medium
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Jul 16, 2026 · Last modified: Jul 16, 2026 · CWE-306
0.1%EPSS · 30 days0.1%
2026-08-042026-08-31
During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-844237.3 HIG—
———A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.6hCVE-2026-796879.0 CRI—
———Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access.8hCVE-2026-187717.5 HIG—
———Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass.
This issue affects Talassoft Industrial Management Software: from V4 before V.16.8hCVE-2026-12663——
———A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.9hCVE-2026-829197.3 HIG—
———A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.9hCVE-2026-829063.7 LOW—
———A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.9h