CVE-2026-79679 | High | 8.7 | 2026-09-03 | Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services.
This issue affects mapp Audit used in mapp Services… |
CVE-2026-66409 | Medium | 5.3 | 2026-08-10 | DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.
The password may be analyzed and obtained to connect t… |
CVE-2026-66408 | Medium | 4.6 | 2026-08-10 | The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.
Physical access to an affected product may allow to obtain the pas… |
CVE-2026-49852 | | | 2026-07-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode… |
CVE-2026-45363 | Critical | 9.1 | 2026-07-14 | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') acc… |
CVE-2026-57473 | | | 2026-06-26 | A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force… |
CVE-2026-47325 | | | 2026-06-03 | ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth… |
CVE-2026-4377 | | | 2026-05-28 | Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords a… |
CVE-2026-35089 | | | 2026-05-27 | In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authenti… |
CVE-2026-44351 | Critical | 9.1 | 2026-05-13 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flo… |
CVE-2026-8076 | | | 2026-05-08 | Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The… |
CVE-2026-39920 | Critical | 9.8 | 2026-04-24 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default… |
CVE-2026-23853 | High | 8.4 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug… |
CVE-2025-67114 | Critical | 9.8 | 2026-03-19 | Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804… |
CVE-2026-22886 | Critical | 9.8 | 2026-03-03 | OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires
authentication. However, the product ships with a default administrative ac… |
CVE-2026-24449 | Medium | 4.6 | 2026-02-03 | For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information. |
CVE-2025-59103 | | | 2026-01-26 | The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it… |
CVE-2026-22910 | High | 7.5 | 2026-01-15 | The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represen… |
CVE-2025-59460 | High | 7.5 | 2025-10-27 | The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increas… |
CVE-2025-30519 | Critical | 9.8 | 2025-09-18 | Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard
administrative means. An attacker w… |
CVE-2025-6737 | High | 7.2 | 2025-08-25 | Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authen… |
CVE-2025-55584 | Medium | 5.3 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account. |
CVE-2025-35970 | High | 7.5 | 2025-08-07 | On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If t… |
CVE-2025-6077 | Critical | 9.8 | 2025-08-02 | Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account… |
CVE-2025-53558 | High | 8.8 | 2025-07-31 | ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log i… |
CVE-2025-6523 | High | 7.7 | 2025-07-22 | Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forci… |
CVE-2025-52364 | High | 7.5 | 2025-07-09 | Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /e… |
CVE-2024-51978 | Critical | 9.8 | 2025-06-25 | An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated att… |
CVE-2025-4057 | Medium | 5.5 | 2025-05-26 | A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies. |
CVE-2025-32471 | Low | 3.7 | 2025-04-28 | The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks. |
CVE-2025-2229 | High | 7.7 | 2025-03-13 | A token is created using the username, current date/time, and a fixed
AES-128 encryption key, which is the same across all installations. |
CVE-2025-1081 | Low | 3.1 | 2025-02-06 | A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the co… |
CVE-2025-22936 | Medium | 5.7 | 2025-02-06 | An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information vi… |
CVE-2024-52331 | High | 7.5 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that… |
CVE-2024-43659 | High | 7.2 | 2025-01-09 | After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Ioc… |
CVE-2024-11717 | | | 2025-01-02 | Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a… |
CVE-2024-12728 | Critical | 9.8 | 2024-12-19 | A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). |
CVE-2024-45722 | High | 7.5 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentia… |
CVE-2024-43698 | Critical | 9.8 | 2024-10-22 | Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system. |
CVE-2024-45272 | High | 7.5 | 2024-10-15 | An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in… |
CVE-2024-42027 | Medium | 6.7 | 2024-10-07 | The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate t… |
CVE-2024-7558 | High | 8.7 | 2024-10-02 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the… |
CVE-2024-40892 | High | 7.1 | 2024-08-12 | A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the licens… |
CVE-2024-42051 | High | 7.8 | 2024-07-28 | The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit… |
CVE-2024-32759 | | | 2024-07-10 | Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials. |
CVE-2024-5634 | | | 2024-07-09 | Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is k… |
CVE-2024-33849 | Medium | 6.5 | 2024-05-28 | ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key. |
CVE-2024-28066 | High | 8.8 | 2024-04-08 | In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password). |
CVE-2024-21865 | Medium | 6.5 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via S… |
CVE-2024-29071 | High | 8.8 | 2024-03-25 | HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings. |
CVE-2023-48257 | High | 7.8 | 2024-01-10 | The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges o… |
CVE-2022-3010 | High | 7.5 | 2024-01-02 | The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calcula… |
CVE-2023-3470 | Medium | 6.0 | 2023-08-02 |
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the p… |
CVE-2023-0635 | High | 7.8 | 2023-06-05 | Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQ… |
CVE-2023-31240 | High | 8.3 | 2023-05-22 | Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hi… |
CVE-2023-28368 | Medium | 5.7 | 2023-04-11 | TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared… |