CVE Program partner

CERTVDE

CERT@VDE

API
CVEs, 365 days240836 all time, 103 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationCERT@VDE
RoleRoot, CNA
TypeCERT
Reports toicscert → CISA
Scope<strong>Root Scope:</strong> Organizations that are cooperative partners of CERT@VDE.<br/><strong>CNA Scope:</strong> Products of CERT@VDE cooperative partners and brands listed at <a href='https://cert.vde.com/en/cna/' target='_blank'>https://cert.vde.com/en/cna/</a>. Also, industrial and infrastructure control systems (and its components) of European Union (EU) based vendors unless covered by the scope of another CNA. Partners and brands include but are not limited to: ADS-TEC Industrial IT, Auma, sipos, Beckhoff, Bender, Bucher Automation, CLAAS, 365FarmNet, Satinfo, Carlo Gavazzi Controls, Codesys, DURAG GROUP, Draeger, Endress+Hauser, Euchner, Festo Didactic, Festo, Frauscher, GEA, HIMA, Harman, Helmholz, Hilscher, K4 DIGITAL, KEB, Krohne, Kuka, Lenze, BHN Services, MB connect line, Miele, Murrelektronik, PHOENIX CONTACT, Etherwan Systems, Innominate, Pepperl+Fuchs, Pilz, SMA, SWARCO, Trumpf, TRUMPF Laser, TRUMPF Werkzeugmaschinen, VARTA Storage, VEGA, WAGO, M&amp;M Software, Weidmueller, Welotec, Wiesemann &amp; Theis, ifm.
Advisorieshttps://cert.vde.com/en-us/advisories

Latest CVEs · RSS

  • CVE-2026-107564 2026-10-16 · CVSS 8.7
    An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leadi
  • CVE-2026-94410 2026-10-13 · CVSS 5.3
    A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentialit
  • CVE-2026-94293 2026-10-06 · CVSS 9.3
    An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
  • CVE-2025-41753 2026-10-01 · CVSS 9.3
    The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited
  • CVE-2026-76992 2026-09-30 · CVSS 8.7
    The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An unauthenticated remote
  • CVE-2026-79625 2026-09-30 · CVSS 7.2
    Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorre
  • CVE-2026-27565 2026-09-16 · CVSS 9.8
    An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains activ
  • CVE-2026-27564 2026-09-16 · CVSS 7.2
    A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin creden
  • CVE-2026-27563 2026-09-16 · CVSS 7.2
    A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admi
  • CVE-2026-27562 2026-09-16 · CVSS 7.2
    A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin cre
  • CVE-2026-27561 2026-09-16 · CVSS 7.2
    A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin cre
  • CVE-2026-27560 2026-09-16 · CVSS 7.2
    A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin
  • CVE-2026-27559 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user crede
  • CVE-2026-27558 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint u
  • CVE-2026-27557 2026-09-16 · CVSS 7.5
    An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's priva
  • CVE-2026-27556 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator co
  • CVE-2026-27555 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie a
  • CVE-2026-27554 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials a
  • CVE-2026-27553 2026-09-16 · CVSS 6.5
    A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user coo
  • CVE-2026-27552 2026-09-16 · CVSS 8.1
    A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device
  • CVE-2026-27551 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing e
  • CVE-2026-27550 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution
  • CVE-2026-27549 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credenti
  • CVE-2026-27548 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credent
  • CVE-2026-27547 2026-09-16 · CVSS 8.8
    A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator c

All CVE Program partners