# cve.now: Codesys

The newest entries naming Codesys as an affected vendor (up to 200), of 104 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-76992](https://cve.now/CVE-2026-76992.md): Uncontrolled Memory Allocation in CODESYS Gateway Client (CVSS 8.7)
- [CVE-2026-79625](https://cve.now/CVE-2026-79625.md): Improper Synchronization in Monitoring in CODESYS Control Runtime (CVSS 7.2)
- [CVE-2026-35226](https://cve.now/CVE-2026-35226.md): Out-of-bounds Write in CODESYS PROFINET Controller (CVSS 7.1)
- [CVE-2026-8047](https://cve.now/CVE-2026-8047.md): Out-of-bounds Write in CODESYS Control (CVSS 8.7)
- [CVE-2026-8046](https://cve.now/CVE-2026-8046.md): Incorrect Authorization in CODESYS Control (CVSS 7.2)
- [CVE-2026-44469](https://cve.now/CVE-2026-44469.md): Incorrect Default Permissions in CODESYS Development System (CVSS 8.5)
- [CVE-2026-44468](https://cve.now/CVE-2026-44468.md): Incorrect Default Permissions in CODESYS Development System (CVSS 8.5)
- [CVE-2026-0393](https://cve.now/CVE-2026-0393.md): CODESYS Visualization - Insufficiently Protected Credentials (CVSS 6.9)
- [CVE-2026-35227](https://cve.now/CVE-2026-35227.md): Improper resource management in CODESYS Modbus TCP Server (CVSS 8.2)
- [CVE-2026-35225](https://cve.now/CVE-2026-35225.md): Improper timeout handling in CODESYS EtherNetIP (CVSS 8.7)
- [CVE-2026-3509](https://cve.now/CVE-2026-3509.md): CODESYS Control Audit Log Format String DoS (CVSS 7.5)
- [CVE-2025-41660](https://cve.now/CVE-2025-41660.md): CODESYS Control Boot Application Replacement Enables Code Execution (CVSS 8.8)
- [CVE-2026-2364](https://cve.now/CVE-2026-2364.md): CODESYS Installer TOCTOU Privilege Escalation (CVSS 7.3)
- [CVE-2025-41700](https://cve.now/CVE-2025-41700.md): CODESYS Development System - Deserialization of Untrusted Data (CVSS 7.8)
- [CVE-2025-41738](https://cve.now/CVE-2025-41738.md): CODESYS Control - Invalid type usage in visualization (CVSS 7.5)
- [CVE-2025-41739](https://cve.now/CVE-2025-41739.md): CODESYS Control - Linux/QNX SysSocket flaw (CVSS 5.9)
- [CVE-2025-41691](https://cve.now/CVE-2025-41691.md): CODESYS Control DoS via Unauthenticated NULL Pointer Dereference (CVSS 7.5)
- [CVE-2025-41659](https://cve.now/CVE-2025-41659.md): CODESYS Control PKI Exposure Enables Remote Certificate Access (CVSS 8.3)
- [CVE-2025-41658](https://cve.now/CVE-2025-41658.md): CODESYS Toolkit Exposes Sensitive Files via Default Permissions (CVSS 5.5)
- [CVE-2025-2595](https://cve.now/CVE-2025-2595.md): Forced Browsing Vulnerability in CODESYS Visualization (CVSS 5.3)
- [CVE-2024-41975](https://cve.now/CVE-2024-41975.md): CODESYS (Edge) Gateway for Windows insecure default (CVSS 5.3)
- [CVE-2025-0694](https://cve.now/CVE-2025-0694.md): CODESYS Control V3 removable media path traversal (CVSS 6.6)
- [CVE-2025-1468](https://cve.now/CVE-2025-1468.md): CODESYS Control V3 - OPC UA Server Authentication bypass (CVSS 7.5)
- [CVE-2024-8175](https://cve.now/CVE-2024-8175.md): CODESYS: web server vulnerable to DoS (CVSS 7.5)
- [CVE-2024-6876](https://cve.now/CVE-2024-6876.md): Out-of-bounds read in OSCAT-Library (CVSS 4.4)
- [CVE-2023-5751](https://cve.now/CVE-2023-5751.md): CODESYS: Development system prone to DoS through exposure of resource to wrong sphere (CVSS 7.8)
- [CVE-2024-5000](https://cve.now/CVE-2024-5000.md): CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products (CVSS 7.5)
- [CVE-2023-49676](https://cve.now/CVE-2023-49676.md): CODESYS: Use after free vulnerability through corrupted project files (CVSS 5.5)
- [CVE-2023-49675](https://cve.now/CVE-2023-49675.md): CODESYS: Out-of-bounds write through corrupted project files (CVSS 7.8)
- [CVE-2023-6357](https://cve.now/CVE-2023-6357.md): OS Command Injection in multiple CODESYS products (CVSS 8.8)
- [CVE-2022-4046](https://cve.now/CVE-2022-4046.md): CODESYS: Improper memory restrictions fro CODESYS Control (CVSS 8.8)
- [CVE-2023-3669](https://cve.now/CVE-2023-3669.md): CODESYS: Missing Brute-Force protection in CODESYS Development System (CVSS 3.3)
- [CVE-2023-37559](https://cve.now/CVE-2023-37559.md): CODESYS Improper Validation of Consistency within Input in multiple products (CVSS 6.5)
- [CVE-2023-37558](https://cve.now/CVE-2023-37558.md): CODESYS Improper Validation of Consistency within Input in multiple products (CVSS 6.5)
- [CVE-2023-37557](https://cve.now/CVE-2023-37557.md): CODESYS Heap-based Buffer Overflow in multiple products (CVSS 6.5)
- [CVE-2023-37556](https://cve.now/CVE-2023-37556.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5)
- [CVE-2023-37555](https://cve.now/CVE-2023-37555.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5)
- [CVE-2023-37554](https://cve.now/CVE-2023-37554.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5)
- [CVE-2023-37553](https://cve.now/CVE-2023-37553.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5)
- [CVE-2023-37552](https://cve.now/CVE-2023-37552.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5)
- [CVE-2023-37551](https://cve.now/CVE-2023-37551.md): CODESYS Files or Directories Accessible to External Parties in CmpApp (CVSS 6.5)
- [CVE-2023-37550](https://cve.now/CVE-2023-37550.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5)
- [CVE-2023-37549](https://cve.now/CVE-2023-37549.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5)
- [CVE-2023-37548](https://cve.now/CVE-2023-37548.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5)
- [CVE-2023-37547](https://cve.now/CVE-2023-37547.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5)
- [CVE-2023-37546](https://cve.now/CVE-2023-37546.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5)
- [CVE-2023-37545](https://cve.now/CVE-2023-37545.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5)
- [CVE-2023-3662](https://cve.now/CVE-2023-3662.md): CODESYS: Vulnerability in CODESYS Development System allows for execution of binaries (CVSS 7.3)
- [CVE-2023-3663](https://cve.now/CVE-2023-3663.md): CODESYS: Missing integrity check in CODESYS Development System (CVSS 8.8)
- [CVE-2023-3670](https://cve.now/CVE-2023-3670.md): Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting (CVSS 7.3)
- [CVE-2022-47393](https://cve.now/CVE-2022-47393.md): CODESYS: Multiple products prone to improperly restricted memory operations (CVSS 6.5)
- [CVE-2022-47392](https://cve.now/CVE-2022-47392.md): CODESYS: Multiple products prone to Improper Input Validation (CVSS 6.5)
- [CVE-2022-47391](https://cve.now/CVE-2022-47391.md): CODESYS: Multiple products prone to Improper Input Validation (CVSS 7.5)
- [CVE-2022-47390](https://cve.now/CVE-2022-47390.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47389](https://cve.now/CVE-2022-47389.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47388](https://cve.now/CVE-2022-47388.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47387](https://cve.now/CVE-2022-47387.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47386](https://cve.now/CVE-2022-47386.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47385](https://cve.now/CVE-2022-47385.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47384](https://cve.now/CVE-2022-47384.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47383](https://cve.now/CVE-2022-47383.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47382](https://cve.now/CVE-2022-47382.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47381](https://cve.now/CVE-2022-47381.md): CODESYS: Multiple products prone to stack based out-of-bounds write (CVSS 8.8)
- [CVE-2022-47380](https://cve.now/CVE-2022-47380.md): CODESYS: Multiple products prone to out-of-bounds write (CVSS 8.8)
- [CVE-2022-47379](https://cve.now/CVE-2022-47379.md): CODESYS: Multiple products prone to out-of-bounds write (CVSS 8.8)
- [CVE-2022-47378](https://cve.now/CVE-2022-47378.md): CODESYS: Multiple products prone to Improper Input Validation (CVSS 6.5)
- [CVE-2022-4048](https://cve.now/CVE-2022-4048.md): CODESYS V3 prone to Inadequate Encryption Stregth (CVSS 7.7)
- [CVE-2022-4224](https://cve.now/CVE-2022-4224.md): CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 (CVSS 8.8)
- [CVE-2018-25048](https://cve.now/CVE-2018-25048.md): Codesys Runtime Improper Limitation of a Pathname (CVSS 8.8)
- [CVE-2020-12069](https://cve.now/CVE-2020-12069.md): CODESYS V3 prone to Inadequate Password Hashing (CVSS 7.8)
- [CVE-2022-1989](https://cve.now/CVE-2022-1989.md): CODESYS Visualization vulnerable to user enumeration (CVSS 5.3)
- [CVE-2022-30792](https://cve.now/CVE-2022-30792.md): CODESYS: CmpChannelServer, CmpChannelServerEmbedded allow unauthenticated attackers to block all their available communication channels (CVSS 7.5)
- [CVE-2022-30791](https://cve.now/CVE-2022-30791.md): CODESYS V3: CmpBlkDrvTcp allows unauthenticated attackers to block all its available TCP connections (CVSS 7.5)
- [CVE-2022-1794](https://cve.now/CVE-2022-1794.md): Plaintext Storage of a password in CODESYS V3 OPC DA Server (CVSS 5.5)
- [CVE-2022-32143](https://cve.now/CVE-2022-32143.md): CODESYS runtime system prone to directory acces (CVSS 8.8)
- [CVE-2022-32142](https://cve.now/CVE-2022-32142.md): CODESYS runtime system prone to denial of service due to use of out of range pointer (CVSS 8.1)
- [CVE-2022-32141](https://cve.now/CVE-2022-32141.md): CODESYS runtime system prone to denial of service due to buffer over read (CVSS 6.5)
- [CVE-2022-32140](https://cve.now/CVE-2022-32140.md): CODESYS runtime system prone to denial of service due to buffer copy (CVSS 6.5)
- [CVE-2022-32139](https://cve.now/CVE-2022-32139.md): CODESYS runtime system prone to denial of service due to out of bounds read (CVSS 6.5)
- [CVE-2022-32138](https://cve.now/CVE-2022-32138.md): CODESYS runtime system prone to denial of service due to Unexpected Sign Extension (CVSS 8.8)
- [CVE-2022-32137](https://cve.now/CVE-2022-32137.md): CODESYS Runtime System prone to heap based buffer overflow (CVSS 8.8)
- [CVE-2022-32136](https://cve.now/CVE-2022-32136.md): Codesys runtime systems: Access of uninitialised pointer lead to denial of service. (CVSS 6.5)
- [CVE-2022-31806](https://cve.now/CVE-2022-31806.md): Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT (CVSS 9.8)
- [CVE-2022-31805](https://cve.now/CVE-2022-31805.md): Insecure transmission of credentials (CVSS 7.5)
- [CVE-2022-31804](https://cve.now/CVE-2022-31804.md): CODESYS Gateway server prone to denial of service attack due to excessive memory allocation (CVSS 7.5)
- [CVE-2022-31803](https://cve.now/CVE-2022-31803.md): CODESYS Gateway Server V2 prone to Denial of Service Attack (CVSS 5.3)
- [CVE-2022-31802](https://cve.now/CVE-2022-31802.md): Partial string comparison in CODESYS gateway server (CVSS 9.8)
- [CVE-2022-1965](https://cve.now/CVE-2022-1965.md): CODESYS runtime system prone to file deletion due to improper error handling (CVSS 8.1)
- [CVE-2022-22519](https://cve.now/CVE-2022-22519.md): Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system. (CVSS 7.5)
- [CVE-2022-22518](https://cve.now/CVE-2022-22518.md): A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy. (CVSS 6.5)
- [CVE-2022-22517](https://cve.now/CVE-2022-22517.md): Communication Components in multiple CODESYS products vulnerable to communication channel disruption (CVSS 7.5)
- [CVE-2022-22516](https://cve.now/CVE-2022-22516.md): CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space. (CVSS 7.8)
- [CVE-2022-22515](https://cve.now/CVE-2022-22515.md): A component of the CODESYS Control runtime system allows read and write access to configuration files (CVSS 8.1)
- [CVE-2022-22514](https://cve.now/CVE-2022-22514.md): Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS. (CVSS 7.1)
- [CVE-2022-22513](https://cve.now/CVE-2022-22513.md): Null Pointer Dereference in multiple CODESYS products can lead to a DoS. (CVSS 6.5)
- [CVE-2021-34599](https://cve.now/CVE-2021-34599.md): Improper Certificate Validation in CODESYS Git (CVSS 7.4)
- [CVE-2021-34596](https://cve.now/CVE-2021-34596.md): CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service (CVSS 6.5)
- [CVE-2021-34595](https://cve.now/CVE-2021-34595.md): CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service (CVSS 8.1)
- [CVE-2021-34593](https://cve.now/CVE-2021-34593.md): CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service (CVSS 7.5)
- [CVE-2021-34586](https://cve.now/CVE-2021-34586.md): CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) (CVSS 7.5)
- [CVE-2021-34585](https://cve.now/CVE-2021-34585.md): CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS) (CVSS 7.5)
- [CVE-2021-34584](https://cve.now/CVE-2021-34584.md): CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS) (CVSS 9.1)
- [CVE-2021-34583](https://cve.now/CVE-2021-34583.md): CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS) (CVSS 7.5)
- [CVE-2015-6460](https://cve.now/CVE-2015-6460.md): Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/codesys
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.