Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,877

Export CSV
CVE-2026-27556

Local File Inclusion in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27555

Local File Inclusion in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27554

Command Injection in /index.php/ajax/save_iodd_parameters

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27551

Command Injection in /index.php/ajax/parameterManage

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-27549

Command Injection in /index.php/attached_devices_tab/do_upload

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Carlo Gavazzi Pepperl Fuchs Phoenix Contact
Products
Yl212cei8m1io Firmware Yl212cpn8m1io Firmware Yn115cei8rpio Firmware and 5 more
CVE-2026-18595

WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wplab
Products
Wordpress Wp-lister Lite For Ebay
CVE-2026-11984

Ad Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spacetime Wordpress
Products
Ad Inserter – Ad Manager & Adsense Ads Wordpress
CVE-2026-89160

pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching

PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Pcre
Products
Pcre2
CVE-2026-89161

pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Pcre
Products
Pcre2