Export limit exceeded: 425948 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found '–' (at char 41), (line:1, col:42)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

Export CSV
CVE-2026-129261

Kingston FURY CTRL RGB Control Software IOCTL NTIOLib_X64.sys exposed ioctl with insufficient access control

A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown function in the library NTIOLib_X64.sys of the component IOCTL Handler. Performing a manipulation results in exposed ioctl with insufficient access control. The attack is only possible with local access.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Kingston
Products
Fury Ctrl Rgb Control Software
CVE-2026-126640

WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import

The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL queries when importing LifterLMS content, allowing high privilege users such as admin, including the administrator of a single site on a multisite network, to perform SQL injection attacks.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Ultimate Csv Importer
CVE-2026-96150

Microsoft Windows Codecs Library Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft Windows Codecs Library allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Office Windows 10 1607 Windows 10 1809 and 21 more
CVE-2026-129258

Tenda AC18 Firmware Upgrade upgrade data authenticity

A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of the argument upgradeFile leads to insufficient verification of data authenticity. The attack may be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Tenda
Products
Ac18 Ac18 Firmware
CVE-2026-126639

WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path

The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not protect the files created by their single post export feature, writing them to a publicly accessible location under a predictable name, allowing unauthenticated attackers to download the content and custom fields of any exported post, including non-public content.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
—
Products
—