Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Sep 23, 2025An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60.CVE-2025-58473 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 8.2
An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exhausting all available device sessions of the Click Programming Software.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Sep 23, 2025An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60.CVE-2025-57882 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 8.2
An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60. The vulnerability allows an unauthenticated attacker to perform a denial-of-service attack by exhausting all available device sessions in the Remote PLC application.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Sep 23, 2025A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC.CVE-2025-55069 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 8.7
A predictable seed in pseudo-random number generator vulnerability has been discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software implements a predictable seed for its pseudo-random number generator, which compromises the security of the generated private keys.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Sep 23, 2025An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60.CVE-2025-55038 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 7.6
An authorization bypass vulnerability has been discovered in the Click Plus C2-03CPU2 device firmware version 3.60. Through the KOPR protocol utilized by the Remote PLC application, authenticated users with low-level access permissions can exploit this vulnerability to read and modify PLC variables beyond their intended authorization level.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Sep 23, 2025The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC.CVE-2025-59484 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govHigh 8.7
The use of a broken or risky cryptographic algorithm was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software uses an insecure implementation of the RSA encryption algorithm.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Sep 23, 2025The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC.CVE-2025-58069 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 6.9
The use of a hard-coded cryptographic key was discovered in firmware version 3.60 of the Click Plus PLC. The vulnerability relies on the fact that the software contains a hard-coded AES key used to protect the initial messages of a new KOPS session.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Sep 23, 2025Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60.CVE-2025-54855 · Other software · AutomationDirect · reported by ics-cert@hq.dhs.govMedium 4.1
Cleartext storage of sensitive information was discovered in Click Programming Software version v3.60. The vulnerability can be exploited by a local user with access to the file system, while an administrator session is active, to steal credentials stored in clear text.
- Product
- CLICK PLUS C0-0x CPU firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautomationdirect.comcisa.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.