Product by CODESYS
CODESYS Runtime Toolkit
27 known vulnerabilities in CODESYS Runtime Toolkit (CODESYS), 0 of them actively exploited (CISA KEV).
Key figures
27
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2021-30186 | CODESYS PLCWinNT: Heap-Based Buffer Overflow | 7.5 | |
| High | CVE-2021-30195 | CODESYS PLCWinNT: Improper Input Validation | 7.5 | |
| High | CVE-2021-34593 | CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service | 7.5 | |
| Critical | CVE-2022-31806 | Insecure default settings in CODESYS Runtime Toolkit 32 bit full and CODESYS PLCWinNT | 9.8 | |
| High | CVE-2022-32137 | CODESYS Runtime System prone to heap based buffer overflow | 8.8 | |
| High | CVE-2022-32143 | CODESYS runtime system prone to directory acces | 8.8 | |
| High | CVE-2022-32138 | CODESYS runtime system prone to denial of service due to Unexpected Sign Extension | 8.8 | |
| High | CVE-2026-76992 | Uncontrolled Memory Allocation in CODESYS Gateway Client | 7.5 | |
| High | CVE-2023-6357 | OS Command Injection in multiple CODESYS products | 8.8 | |
| High | CVE-2022-32142 | CODESYS runtime system prone to denial of service due to use of out of range pointer | 8.1 | |
| High | CVE-2022-1965 | CODESYS runtime system prone to file deletion due to improper error handling | 8.1 | |
| High | CVE-2022-4224 | CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 | 8.8 | |
| High | CVE-2026-79625 | Improper Synchronization in Monitoring in CODESYS Control Runtime | 8.1 | |
| High | CVE-2022-31805 | Insecure transmission of credentials | 7.5 | |
| Medium | CVE-2019-19789 | CODESYS PLCWinNT: NULL Pointer Dereference | 6.5 | |
| High | CVE-2021-33486 | CODESYS Runtime Toolkit: security vulnerability | 7.5 | |
| High | CVE-2021-34595 | CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service | 8.1 | |
| Medium | CVE-2022-32140 | CODESYS runtime system prone to denial of service due to buffer copy | 6.5 | |
| Medium | CVE-2022-32141 | CODESYS runtime system prone to denial of service due to buffer over read | 6.5 | |
| Medium | CVE-2022-32139 | CODESYS runtime system prone to denial of service due to out of bounds read | 6.5 | |
| Medium | CVE-2022-32136 | CODESYS Runtime Toolkit: Access of Uninitialized Pointer | 6.5 | |
| Medium | CVE-2021-34596 | CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service | 6.5 | |
| High | CVE-2025-41738 | CODESYS Control - Invalid type usage in visualization | 7.5 | |
| High | CVE-2025-41659 | CODESYS Control PKI Exposure Enables Remote Certificate Access | 8.3 | |
| High | CVE-2019-9013 | CODESYS Development System: security vulnerability | 8.8 |