CVE-2026-65313 | High | 8.1 | 2026-07-31 | A provisioning script used when installing HIPASE-250 (formerly 250
SCALA) engineering workstations sets a fixed, hard-coded x11vnc
password. Because the same… |
CVE-2026-68503 | Critical | 9.8 | 2026-07-30 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn… |
CVE-2026-41939 | Critical | 9.8 | 2026-07-29 | Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthentic… |
CVE-2026-44761 | Critical | 9.1 | 2026-07-14 | SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help P… |
CVE-2026-3144 | High | 8.1 | 2026-07-08 | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the syst… |
CVE-2026-58466 | Critical | 9.8 | 2026-07-02 | AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by… |
CVE-2026-58453 | Critical | 9.8 | 2026-07-01 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to g… |
CVE-2026-46386 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERW… |
CVE-2026-44273 | Medium | 6.0 | 2026-06-22 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker with local access… |
CVE-2026-32652 | High | 7.8 | 2026-06-17 | Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability. A low privileged attacker with console access could potenti… |
CVE-2026-50005 | High | 7.7 | 2026-06-11 | Brickcom cameras
ship with default credentials that allows any unauthenticated remote attacker to silently access camera feeds. |
CVE-2026-9844 | | | 2026-06-02 | Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Pas… |
CVE-2026-42941 | High | 8.3 | 2026-05-29 | The Danelec MacGregor Voyage Data Recorder
device includes a default username and password, with no enforced password change. |
CVE-2026-45039 | Critical | 9.8 | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 sig… |
CVE-2026-7365 | High | 8.4 | 2026-05-27 | IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process fo… |
CVE-2025-36221 | Medium | 5.3 | 2026-05-26 | IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manuf… |
CVE-2026-44159 | Critical | 9.8 | 2026-05-19 | Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change the credentials before deployment. TID-L has… |
CVE-2026-7428 | | | 2026-05-12 | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default… |
CVE-2026-42072 | Critical | 9.8 | 2026-05-08 | Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, th… |
CVE-2023-27573 | Critical | 9.0 | 2026-03-11 | netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567… |
CVE-2026-31837 | High | 7.5 | 2026-03-10 | Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver b… |
CVE-2026-28713 | High | 7.1 | 2026-03-06 | Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before… |
CVE-2026-22886 | Critical | 9.8 | 2026-03-03 | OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires
authentication. However, the product ships with a default administrative ac… |
CVE-2026-27751 | Critical | 9.8 | 2026-02-27 | SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative ac… |
CVE-2026-26341 | Critical | 9.8 | 2026-02-24 | Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be changed during inst… |
CVE-2026-26366 | Critical | 9.8 | 2026-02-15 | eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without… |
CVE-2025-54756 | High | 8.4 | 2026-02-12 | BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or
series 5 prior to v9.0.166 use a default password that is guessable with
knowledge of… |
CVE-2026-1972 | Medium | 5.3 | 2026-02-06 | A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument User… |
CVE-2026-1803 | High | 8.1 | 2026-02-03 | A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes u… |
CVE-2025-7740 | | | 2026-01-28 | Default credentials vulnerability exists in SuprOS
product. If exploited, this could allow an authenticated
local attacker to use an admin account created duri… |
CVE-2025-59108 | | | 2026-01-26 | By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced. |
CVE-2026-22273 | High | 8.8 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Use of Default Credentials vulnerability in the OS. A l… |
CVE-2025-58744 | High | 7.5 | 2026-01-20 | Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in
Milner ImageDirector Capture on Windows allows decryption of do… |
CVE-2020-36915 | High | 7.5 | 2026-01-06 | Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet… |
CVE-2022-50803 | Critical | 9.8 | 2025-12-30 | JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges. |
CVE-2018-25147 | High | 7.5 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these defa… |
CVE-2021-47707 | | | 2025-12-09 | COMMAX CVD-Axx DVR 5.1.4 contains weak default administrative credentials that allow remote password attacks and disclose RTSP stream. Attackers can exploit th… |
CVE-2025-54303 | Critical | 9.8 | 2025-12-04 | The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user… |
CVE-2025-12592 | | | 2025-11-19 | Legacy Vivotek Device firmware uses default credetials for the root and user login accounts. |
CVE-2025-12218 | Critical | 9.1 | 2025-10-25 | Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-12217 | Critical | 9.1 | 2025-10-25 | SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
CVE-2025-10678 | | | 2025-10-20 | NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL.
This issue affect… |
CVE-2025-11943 | High | 7.3 | 2025-10-19 | A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The m… |
CVE-2025-34516 | Critical | 9.8 | 2025-10-16 | Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain rem… |
CVE-2025-10542 | Critical | 9.8 | 2025-09-25 | iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrato… |
CVE-2025-35042 | Critical | 9.8 | 2025-09-22 | Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change… |
CVE-2025-55110 | Medium | 5.5 | 2025-09-16 | Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented.
An attacker with read access to the… |
CVE-2025-55051 | Critical | 10.0 | 2025-09-09 | CWE-1392: Use of Default Credentials |
CVE-2025-35452 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface. |
CVE-2025-9577 | Low | 2.5 | 2025-08-28 | A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component… |
CVE-2025-9576 | Low | 2.5 | 2025-08-28 | A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component Administrative Int… |
CVE-2025-35114 | High | 7.5 | 2025-08-26 | Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one… |
CVE-2025-29525 | Medium | 5.3 | 2025-08-25 | DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control pane… |
CVE-2025-29521 | Medium | 5.3 | 2025-08-25 | Insecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to escalate privileges… |
CVE-2025-55740 | Medium | 6.5 | 2025-08-19 | nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. Thi… |
CVE-2025-2184 | | | 2025-08-13 | A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal… |
CVE-2025-8731 | Critical | 9.8 | 2025-08-08 | A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The man… |
CVE-2025-8530 | Medium | 5.3 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the f… |
CVE-2025-51535 | Critical | 9.1 | 2025-08-04 | Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability. |
CVE-2025-51536 | Critical | 9.8 | 2025-08-04 | Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password. |
CVE-2025-29629 | Critical | 9.1 | 2025-07-25 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for… |
CVE-2025-54137 | High | 7.3 | 2025-07-22 | HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credent… |
CVE-2025-7907 | Medium | 4.3 | 2025-07-20 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/sr… |
CVE-2025-1711 | Medium | 4.3 | 2025-07-03 | Multiple services of the DUT as well as different scopes of the same service reuse the same credentials. |
CVE-2025-6951 | Medium | 4.3 | 2025-07-01 | A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611. This vulnerability affects unknown code of the component FTP Service. The m… |
CVE-2025-52997 | Medium | 5.9 | 2025-06-30 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to ver… |
CVE-2025-6529 | High | 8.8 | 2025-06-23 | A vulnerability was found in 70mai M300 up to 20250611 and classified as critical. Affected by this issue is some unknown functionality of the component Telnet… |
CVE-2024-40113 | Medium | 6.5 | 2025-06-02 | Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials. |
CVE-2025-5124 | High | 8.1 | 2025-05-24 | A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects… |
CVE-2025-1531 | Medium | 6.5 | 2025-05-16 | Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viewpoint: from 10.0… |
CVE-2025-22460 | High | 7.8 | 2025-05-13 | Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privileges. |
CVE-2024-46899 | High | 7.1 | 2025-04-22 | Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue aff… |
CVE-2025-30139 | Critical | 9.8 | 2025-03-18 | An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials t… |
CVE-2025-2398 | High | 7.2 | 2025-03-17 | A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical… |
CVE-2025-2341 | Low | 3.1 | 2025-03-16 | A vulnerability was found in IROAD Dash Cam X5 up to 20250203. It has been rated as problematic. This issue affects some unknown processing of the component SS… |
CVE-2025-2119 | Low | 2.0 | 2025-03-09 | A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been declared as problematic. This vulnerability affects unknown code of the… |
CVE-2024-13893 | | | 2025-03-06 | Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet ser… |
CVE-2024-12013 | High | 7.6 | 2025-02-13 | A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server wit… |
CVE-2024-54015 | High | 7.5 | 2025-02-11 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6M… |
CVE-2025-1160 | High | 7.3 | 2025-02-10 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-23012 | High | 7.5 | 2025-01-23 | Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastr… |
CVE-2025-0482 | High | 7.3 | 2025-01-15 | A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd… |
CVE-2024-12856 | High | 7.2 | 2024-12-27 | The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows aut… |
CVE-2024-12902 | High | 8.4 | 2024-12-23 | ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privil… |
CVE-2024-10476 | High | 8.0 | 2024-12-17 | Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, in… |
CVE-2024-12286 | Critical | 9.8 | 2024-12-10 | MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials. |
CVE-2024-45068 | High | 7.1 | 2024-12-03 | Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA.
This issue affects Hitachi Ops Center C… |
CVE-2024-6245 | High | 7.4 | 2024-10-28 | Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and… |
CVE-2024-39747 | High | 8.1 | 2024-08-31 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses default credentials for potentially critical functionality. |
CVE-2024-39584 | High | 8.2 | 2024-08-28 | Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with local access could potentially exploit th… |
CVE-2024-7898 | High | 7.3 | 2024-08-17 | A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of… |
CVE-2024-7746 | Critical | 9.8 | 2024-08-13 | Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the… |
CVE-2024-6788 | High | 8.6 | 2024-08-13 | A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileg… |
CVE-2023-40704 | Medium | 6.8 | 2024-07-18 | The product does not require unique and complex passwords to be created
during installation. Using Philips's default password could jeopardize
the PACS syste… |
CVE-2024-6535 | Medium | 5.3 | 2024-07-17 | A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-pro… |
CVE-2024-5632 | | | 2024-07-09 | Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default password.
A user is neit… |
CVE-2024-4007 | High | 8.8 | 2024-07-01 | Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured. |
CVE-2024-27158 | High | 7.4 | 2024-06-14 | All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL. |
CVE-2023-43844 | High | 8.0 | 2024-05-28 | Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credentials after first… |
CVE-2024-5245 | High | 7.8 | 2024-05-23 | NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate p… |