Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Mar 18, 2025Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.CVE-2025-0694 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.6
Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.CVE-2024-8175 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can causes the CODESYS web server to access invalid memory which results in a DoS.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcustomers.codesys.com
Jun 4, 2024An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorreCVE-2024-5000 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can use a malicious OPC UA client to send a crafted request to affected CODESYS products which can cause a DoS due to incorrect calculation of buffer size.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcustomers.codesys.com
Dec 5, 2023A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker fCVE-2023-6357 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges CVE-2022-4046 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.8
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent cCVE-2023-37559 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37558
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent cCVE-2023-37558 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted network communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37559
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppCVE-2023-37557 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
After successful authentication as a user in multiple Codesys products in multiple versions, specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37556 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37555.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37555 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37554 and CVE-2023-37556.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37554 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37553, CVE-2023-37555 and CVE-2023-37556.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37553 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37552, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37552 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple versions of multiple Codesys products, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37553, CVE-2023-37554, CVE-2023-37555 and CVE-2023-37556.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CCVE-2023-37551 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37550 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37549.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37549 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37548 and CVE-2023-37550
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37548 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37547, CVE-2023-37549 and CVE-2023-37550
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37547 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37546, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37546 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37545, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549 and CVE-2023-37550
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 3, 2023In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent CVE-2023-37545 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
In multiple Codesys products in multiple versions, after successful authentication as a user, specific crafted network communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-of-service condition. This vulnerability is different to CVE-2023-37546, CVE-2023-37547, CVE-2023-37548, CVE-2023-37549, CVE-2023-37550
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 7, 2022A bug in CmpUserMgr component can lead to only partially applied security policies.CVE-2022-22518 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the applied security policy.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.