CWE-1188 · Initialization of a Resource with an Insecure Default (page 2)
Page 2 of 4 — CVEs classified under CWE-1188, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31957 | Critical | 10.0 | 2026-03-11 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelblau is deployed without a configured ten… |
CVE-2018-25193 | High | 7.5 | 2026-03-06 | Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connection… |
CVE-2018-25169 | High | 7.5 | 2026-03-06 | AMPPS 2.7 contains a denial of service vulnerability that allows remote attackers to crash the service by sending malformed data to the default HTTP port. Atta… |
CVE-2026-26122 | Medium | 6.5 | 2026-03-05 | Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
CVE-2026-28775 | Critical | 9.8 | 2026-03-04 | An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex Sat… |
CVE-2025-70998 | Critical | 9.8 | 2026-02-18 | UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote… |
CVE-2026-2617 | Medium | 6.3 | 2026-02-17 | A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation resul… |
CVE-2026-25894 | Critical | 9.8 | 2026-02-09 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker… |
CVE-2026-1675 | Medium | 5.3 | 2026-02-07 | The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predict… |
CVE-2026-25499 | High | 7.5 | 2026-02-04 | Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configuration documentation, the sudoer line su… |
CVE-2025-69970 | Critical | 9.3 | 2026-02-03 | FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causi… |
CVE-2025-59097 | | 2026-01-26 | The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the d… | |
CVE-2025-59090 | | 2026-01-26 | On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network acces… | |
CVE-2025-62877 | Critical | 9.8 | 2026-01-08 | Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive i… |
CVE-2025-5591 | Medium | 5.4 | 2026-01-05 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and per… |
CVE-2025-56332 | Critical | 9.1 | 2025-12-30 | Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration |
CVE-2025-14758 | Medium | 6.5 | 2025-12-16 | Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database co… |
CVE-2025-66482 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate… |
CVE-2025-64781 | Medium | 4.7 | 2025-12-12 | In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restric… |
CVE-2025-48629 | High | 7.8 | 2025-12-08 | In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default v… |
CVE-2025-48621 | High | 7.3 | 2025-12-08 | In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privi… |
CVE-2025-66416 | High | 8.1 | 2025-12-02 | The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol… |
CVE-2025-66414 | High | 8.1 | 2025-12-02 | MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript… |
CVE-2025-52622 | Medium | 5.4 | 2025-12-02 | The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, makin… |
CVE-2025-13357 | High | 7.4 | 2025-11-21 | Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insec… |
CVE-2025-35021 | Medium | 6.5 | 2025-11-04 | By failing to authenticate three times to an unconfigured Abilis CPX device via SSH, an attacker can login to a restricted shell on the fourth attempt, and fro… |
CVE-2025-64135 | Medium | 5.9 | 2025-10-29 | Jenkins Eggplant Runner Plugin 0.0.1.301.v963cffe8ddb_8 and earlier sets the Java system property `jdk.http.auth.tunneling.disabledSchemes` to an empty value… |
CVE-2025-62802 | Medium | 4.3 | 2025-10-28 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HT… |
CVE-2025-61481 | Critical | 10.0 | 2025-10-27 | An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an on-path attacker to… |
CVE-2025-41245 | Medium | 4.9 | 2025-09-29 | VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit th… |
CVE-2025-57295 | High | 8.0 | 2025-09-18 | H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no passw… |
CVE-2025-43797 | Medium | 5.4 | 2025-09-15 | In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and olde… |
CVE-2025-41713 | Medium | 6.5 | 2025-09-15 | During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating… |
CVE-2025-36222 | High | 8.7 | 2025-09-11 | IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations… |
CVE-2025-59044 | Medium | 4.4 | 2025-09-09 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups from the group displ… |
CVE-2025-32330 | Medium | 5.7 | 2025-09-04 | In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecure default value. T… |
CVE-2025-38523 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the s… |
CVE-2025-7353 | | 2025-08-14 | A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to… | |
CVE-2025-54127 | Critical | 9.8 | 2025-07-21 | HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses… |
CVE-2025-44647 | High | 7.3 | 2025-07-21 | In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE… |
CVE-2025-25271 | High | 8.8 | 2025-07-08 | An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface. |
CVE-2025-41672 | Critical | 10.0 | 2025-07-07 | A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices. |
CVE-2025-53602 | Medium | 5.3 | 2025-07-04 | Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use of Spring Boot Actuator), a similar issue to CVE-2025-48927. |
CVE-2025-24288 | Critical | 9.8 | 2025-06-19 | The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most… |
CVE-2025-41438 | Critical | 9.8 | 2025-05-30 | The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, i… |
CVE-2025-48927 | Medium | 5.3 | 2025-05-28 | The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in M… |
CVE-2025-47945 | Critical | 9.1 | 2025-05-17 | Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the sign… |
CVE-2025-31930 | High | 8.8 | 2025-05-13 | A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2E… |
CVE-2025-22248 | High | 7.5 | 2025-05-13 | The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated a… |
CVE-2025-46599 | Medium | 6.8 | 2025-04-25 | CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is se… |
CVE-2025-1863 | Critical | 9.8 | 2025-04-18 | Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is… |
CVE-2025-43015 | High | 8.3 | 2025-04-17 | In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces |
CVE-2025-2442 | Medium | 6.8 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in t… |
CVE-2025-2441 | Medium | 4.6 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having p… |
CVE-2025-27443 | Low | 2.8 | 2025-04-08 | Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local acces… |
CVE-2025-29985 | Medium | 6.5 | 2025-04-08 | Dell Common Event Enabler, version(s) CEE 9.0.0.0, contain(s) an Initialization of a Resource with an Insecure Default vulnerability in the Common Anti-Virus A… |
CVE-2025-27809 | Medium | 5.4 | 2025-03-25 | Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client… |
CVE-2024-8313 | | 2025-03-25 | An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SN… | |
CVE-2024-41975 | Medium | 5.3 | 2025-03-18 | An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs. |
CVE-2025-1960 | Critical | 9.8 | 2025-03-12 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a syste… |
CVE-2025-2129 | Medium | 5.6 | 2025-03-09 | A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default in… |
CVE-2024-50390 | Critical | 9.8 | 2025-03-07 | A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands… |
CVE-2022-49099 | Medium | 5.5 | 2025-02-26 | In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix initialization of device object in vmbus_device_register() Initia… |
CVE-2024-48122 | Medium | 6.7 | 2025-01-15 | Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges. |
CVE-2024-56433 | Low | 3.6 | 2024-12-26 | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can r… |
CVE-2024-51758 | | 2024-11-07 | Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesy… | |
CVE-2020-11917 | Medium | 4.3 | 2024-11-07 | An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. It uses a default SSID value, which makes it easier for remote attackers to discover the phy… |
CVE-2019-25219 | High | 7.5 | 2024-10-29 | Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL_ERROR_SYSCALL with no associated error information from the SSL library being use… |
CVE-2024-9949 | Medium | 6.1 | 2024-10-23 | Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service i… |
CVE-2024-30124 | Medium | 4.0 | 2024-10-23 | HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol… |
CVE-2024-45217 | High | 8.1 | 2024-10-16 | Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from t… |
CVE-2024-47295 | High | 8.1 | 2024-10-01 | Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the d… |
CVE-2024-0001 | Critical | 10.0 | 2024-09-23 | A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor… |
CVE-2024-44096 | Medium | 4.4 | 2024-09-13 | there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. U… |
CVE-2024-8383 | High | 7.5 | 2024-09-03 | Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did n… |
CVE-2024-45313 | Medium | 5.4 | 2024-09-02 | Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 2024-07-17 or legacy docker-compose.yml f… |
CVE-2024-34734 | High | 7.8 | 2024-08-15 | In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure… |
CVE-2024-5801 | | 2024-08-12 | Enabled IP Forwarding feature in B&R Automation Runtime versions before 6.0.2 may allow remote attack-ers to compromise network security by routing IP-based pa… | |
CVE-2024-41995 | High | 7.5 | 2024-08-06 | Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the pr… |
CVE-2024-31070 | Critical | 9.1 | 2024-07-17 | Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. al… |
CVE-2024-39916 | Medium | 6.4 | 2024-07-12 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports genera… |
CVE-2021-47343 | High | 7.8 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remo… |
CVE-2024-34063 | Low | 2.5 | 2024-05-03 | vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to chan… |
CVE-2024-32114 | High | 8.5 | 2024-05-02 | In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It… |
CVE-2024-2912 | Critical | 10.0 | 2024-04-16 | An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By… |
CVE-2024-28815 | Critical | 9.8 | 2024-03-27 | A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes… |
CVE-2024-25972 | High | 8.3 | 2024-03-01 | Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unaut… |
CVE-2024-0387 | Medium | 6.5 | 2024-02-26 | The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to th… |
CVE-2024-26267 | Medium | 5.3 | 2024-02-20 | In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, an… |
CVE-2024-25610 | Critical | 9.0 | 2024-02-20 | In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and… |
CVE-2023-48733 | Medium | 6.7 | 2024-02-14 | An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot. |
CVE-2024-22388 | Medium | 5.9 | 2024-02-06 | Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data… |
CVE-2024-22207 | Medium | 5.3 | 2024-01-15 | fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will l… |
CVE-2023-6448 | Critical | 9.8 | 2023-12-05 | Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with ne… |
CVE-2023-27516 | High | 7.3 | 2023-10-12 | An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network p… |
CVE-2023-45312 | High | 8.8 | 2023-10-10 | In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installa… |
CVE-2023-5368 | Medium | 6.5 | 2023-10-04 | On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated dat… |
CVE-2023-40708 | Medium | 5.8 | 2023-08-24 | The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files. |
CVE-2023-3453 | High | 7.1 | 2023-08-23 | ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network acc… |
CVE-2023-35689 | High | 7.8 | 2023-08-14 | In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This c… |