Login Request a demo
CO
Product
Codesys
by Codesys · last CVE Dec 1, 2025
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 2High 10Medium 1Low 0
Severity
All severities13Critical2High10Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Codesys to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-13538
8.6
1%
Sep 17
3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity,…
Affected: before 3.5.16.0
CVE-2021-34595
8.1
1%
Oct 26
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56,…
Affected: before 1.1.9.22
CVE-2025-41700
7.8
0%
Dec 1
CODESYS Development System - Deserialization of Untrusted Data
Affected: before 3.5.21.40
CVE-2021-21869
7.8
2%
Aug 25
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17
Affected: 3.5.16.0; 3.5.17.0
CVE-2021-21868
7.8
2%
Aug 18
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17
Affected: 3.5.16.0; 3.5.17.0
CVE-2021-21867
7.8
2%
Aug 18
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17
Affected: 3.5.16.0; 3.5.17.0
CVE-2021-34586
7.5
14%
Oct 26
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service…
Affected: before 1.1.9.22
CVE-2021-34585
7.5
1%
Oct 26
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error
Affected: before 1.1.9.22
CVE-2021-34583
7.5
9%
Oct 26
Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to…
Affected: before 1.1.9.22
CVE-2019-5105
7.5
2%
Mar 26
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService
Affected: 3.5.13.2
Showing 10