Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

36 results

Mar 18, 2025Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.CVE-2025-0694 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.6
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com
Sep 25, 2024An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.CVE-2024-8175 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com customers.codesys.com
Jun 4, 2024An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorreCVE-2024-5000 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com customers.codesys.com
Dec 5, 2023A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker fCVE-2023-6357 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record https cert.vde.com
Aug 3, 2023In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges CVE-2022-4046 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.8
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent cCVE-2023-37559 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent cCVE-2023-37558 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppCVE-2023-37557 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37556 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37555 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37554 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37553 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37552 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CCVE-2023-37551 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37550 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37549 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37548 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37547 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37546 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37545 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Mar 23, 2023The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system fCVE-2018-25048 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.8
The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.
Product
Control for BeagleBone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com customers.codesys.com
Apr 7, 2022A bug in CmpUserMgr component can lead to only partially applied security policies.CVE-2022-22518 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the applied security policy.
Product
CODESYS Control for BeagleBone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com customers.codesys.com
May 3, 2021CODESYS Control Runtime system before 3.5.17.0 has improper input validation.CVE-2021-29242 · Other software · Codesys · reported by MITREHigh 7.3
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
Product
Control For Beaglebone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com customers.codesys.com
May 3, 2021CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).CVE-2021-29241 · Other software · Codesys · reported by MITREHigh 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
Product
Control For Beaglebone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com customers.codesys.com
Jul 22, 2020CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.CVE-2020-15806 · Other software · Codesys · reported by MITREHigh 7.5
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com codesys.com
May 14, 2020An issue was discovered in CODESYS Development System before 3.5.16.0.CVE-2020-12068 · Other software · Codesys · reported by MITREMedium 6.5
An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com codesys.com
Mar 26, 2020CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.CVE-2020-10245 · Other software · Codesys · reported by MITRECritical 9.8
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com tenable.com
Jan 24, 2020CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.CVE-2020-7052 · Other software · Codesys · reported by MITREMedium 6.5
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com tenable.com
Nov 20, 2019CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.CVE-2019-18858 · Other software · Codesys · reported by MITRECritical 9.8
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com tenable.com
Sep 17, 2019An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 .CVE-2019-9009 · Other software · Codesys · reported by MITREHigh 7.5
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com us-cert.gov
Sep 17, 2019An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30.CVE-2019-9008 · Other software · Codesys · reported by MITREHigh 8.8
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com codesys.com
Sep 13, 2019CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow aCVE-2019-13548 · Other software · Codesys · reported by ics-cert@hq.dhs.govCritical 9.8
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Sep 13, 2019CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outsCVE-2019-13532 · Other software · Codesys · reported by ics-cert@hq.dhs.govHigh 7.5
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
Product
Control For Beaglebone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Aug 15, 2019An issue was discovered in 3S-Smart CODESYS V3 products.CVE-2019-9012 · Other software · Codesys · reported by MITREHigh 7.5
An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
Product
Control For Beaglebone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com us-cert.gov
Aug 15, 2019An issue was discovered in 3S-Smart CODESYS V3 products.CVE-2019-9010 · Other software · Codesys · reported by MITRECritical 9.8
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
Product
Control For Beaglebone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com us-cert.gov
Aug 15, 2019An issue was discovered in 3S-Smart CODESYS V3 products.CVE-2019-9013 · Other software · Codesys · reported by MITREHigh 8.8
An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.
Product
Control For Beaglebone SL
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record customers.codesys.com us-cert.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.