What’s Vulnerable › Products

CODESYS HMI (SL) vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your CODESYS HMI (SL) version is affected

Latest CODESYS HMI (SL) vulnerabilities

• CVE-2026-76992 — Uncontrolled Memory Allocation in CODESYS Gateway Client (CVSS 7.5)
• CVE-2026-79625 — Improper Synchronization in Monitoring in CODESYS Control Runtime (CVSS 8.1)
• CVE-2025-41738 — CODESYS Control - Invalid type usage in visualization (CVSS 7.5)
• CVE-2025-41691 — CODESYS Control DoS via Unauthenticated NULL Pointer Dereference (CVSS 7.5)
• CVE-2025-41659 — CODESYS Control PKI Exposure Enables Remote Certificate Access (CVSS 8.3)
• CVE-2023-5751 — CODESYS: Development system prone to DoS through exposure of resource to wrong sphere (CVSS 7.8)
• CVE-2022-4046 — CODESYS: Improper memory restrictions fro CODESYS Control (CVSS 8.8)
• CVE-2022-4224 — CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 (CVSS 8.8)
• CVE-2022-31805 — Insecure transmission of credentials (CVSS 4.3)
• CVE-2022-22519 — Special HTTP(s) Requests can cause a buffer-read causing a crash of the webserver and the runtime system. (CVSS 7.5)
• CVE-2022-22517 — Communication Components in multiple CODESYS products vulnerable to communication channel disruption (CVSS 7.5)
• CVE-2022-22515 — A component of the CODESYS Control runtime system allows read and write access to configuration files (CVSS 4.9)
• CVE-2022-22514 — Untrusted Pointer Dereference in multiple CODESYS products can lead to a DoS. (CVSS 7.1)
• CVE-2022-22513 — Null Pointer Dereference in multiple CODESYS products can lead to a DoS. (CVSS 6.5)
• CVE-2019-9013 — (CVSS 8.8)
• CVE-2018-20026 — (CVSS 7.5)
• CVE-2018-20025 — (CVSS 7.5)
• CVE-2018-10612 — (CVSS 9.8)